Rootkit May Be Behind Windows Blue Screen

Sounds like a good thing by Anonymous Coward · 2010-02-12 05:33 · Score: 5, Insightful

That's one way of forcing users to take care of an infection.

Re:Sounds like a good thing by Anonymous Coward · 2010-02-12 05:46 · Score: 2, Funny

That's one way of forcing users to take care of an infection.
Let me try to respin it into an anti-Microsoft jab:
Windows API is such a jumbled mess of spaghetti code that not even low-level processes related to accessing the hard drive are safe from updates!
Re:Sounds like a good thing by Opportunist · 2010-02-12 06:36 · Score: 2, Insightful

So I'd call that latest update a critical security fix. Install immediately!

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:Sounds like a good thing by SCPaPaJoe · 2010-02-12 06:37 · Score: 3, Funny

I sure am glad I have Vista!!!
Re:Sounds like a good thing by Opportunist · 2010-02-12 06:38 · Score: 3, Interesting

Uh... maybe they were fixing the loophole the spyware used to dig itself into the system? The fix plugged the hole, the (declared as system critical) spyware driver could not load, poof, BSOD.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:Sounds like a good thing by FatdogHaiku · 2010-02-12 06:50 · Score: 2, Funny

I sure am glad I have Vista!!!
I understand each of the words.
I can pronounce all the syllables.
Yet this string will not register in my brain...
It's as if this arrangement of characters should not be.
Like some great sacrilege has sprung into being.

--
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
Re:Sounds like a good thing by Sleepy · 2010-02-12 07:14 · Score: 4, Insightful

That's a strawman argument.
It's natural for security minded folks to "jab" at Microsoft (in a manner similar to how safety advocates "jab" at lead-painted Chinese toys).
On a SANE OS, rootkits can't be installed by regular users who are viewing a banner ad, or plugging in a storage device like a memory stick or USB picture frame.
Re:Sounds like a good thing by cbhacking · 2010-02-12 08:06 · Score: 2, Insightful

... unless you run with maximum permissions (root/Administrator). Vulnerabilities in Flashplayer are typically cross-platform; an exploit that works in Windows will work (after modification, but it will work) on Linux too. The difference usually just comes down to the degree of harm possible. Besides, while I don't know how this particular infection spreads, the odds are very good that it's a trojan... such things work quite nicely on *any* system where the user can get full permissions (almost everything except locked-down business machines) and doesn't know much about computer safety (the vast majority of non-Linux PC users, and some of the Linux users too).
In any case, stardard user accounts can't make changes like that. While EoP exploits may well exist, there are none I know of being used in the wild right now, and Microsoft takes patching them quite seriously. In any case, the specific OS version you're referring to is so old that it was designed for computers that listed their clock speeds in MHz and their hard disks in tens of GB. If it were *anybody* other than Microsoft, they wouldn't still be getting security updates at all!

--
There's no place I could be, since I've found Serenity...
Re:Sounds like a good thing by Spy+der+Mann · 2010-02-12 10:33 · Score: 3, Insightful

Yes, because Linux has no local privilege escalation vulnerabilities, right? This sane OS of yours, does it come with rainbow pooping unicorns too?
In a SANE OS, hackers NEED to escalate privileges to gain administrator privileges for their rogue processes.
In Windows, you ALREADY have administrator privileges! Right from the start!
Re:Sounds like a good thing by ozmanjusri · 2010-02-12 14:56 · Score: 4, Insightful

Vulnerabilities in Flashplayer are typically cross-platform; an exploit that works in Windows will work (after modification, but it will work) on Linux too.
Can you link to any actual exploits, not just those imagined by Microsoft's marketing department?

--
"I've got more toys than Teruhisa Kitahara."

Ah, well, that lets Microsoft off the hook then by Rogerborg · 2010-02-12 05:34 · Score: 2, Insightful

After all, there's no way that their malware tool could have spotted it, or the update could have checksummed the files before patching them.

If they put half as much effort into their anti-malware activities as they do into their DRM regime, the world would be a better place. We'd all have unicorns, and a pot of gold.

--
If you were blocking sigs, you wouldn't have to read this.

Re:Ah, well, that lets Microsoft off the hook then by Com2Kid · 2010-02-12 05:40 · Score: 5, Insightful

After all, there's no way that their malware tool could have spotted it
If a system has been rooted, nothing short of booting to another OS from a known clean media, mounting the disk read only, and scanning, is guaranteed to detect a root kit.
That'd make updates a real pain in the arse to install...

--
Need help treating your acne? Come here!
Re:Ah, well, that lets Microsoft off the hook then by girlintraining · 2010-02-12 05:43 · Score: 3, Insightful

After all, there's no way that their malware tool could have spotted it, or the update could have checksummed the files before patching them.

Well, actually no. Most rootkits either modify the permissions or patch critical system files that cannot be easily replaced, as this one does. It's designed to be stealthy -- so if you scan it, it will return a byte-for-byte copy of the original, which is kept elsewhere, while the operating system loads the infected one at boot.
Saying Microsoft is responsible for ensuring compatability with 3rd party software is ludicrious. This is like potholes -- while the government has a responsibility to patch the roads up so they remain drivable, cars are nonetheless designed with shocks and drivers are expected to watch for road hazards and avoid them as much as possible as well. It is a joint responsibility. Microsoft is not the sole responsible party here: The user shares the responsibility of ensuring the system has not been compromised.

--
#fuckbeta #iamslashdot #dicemustdie
Re:Ah, well, that lets Microsoft off the hook then by _xeno_ · 2010-02-12 05:44 · Score: 3, Insightful

Isn't one of the things a rootkit does is attempt to prevent detection?
How do you know that they don't try and match checksums, only the rootkit was returning the "correct" data in order to hide its presence? I mean, it is in the system file that handles reading data from hard drives, which sounds like the perfect place to put in code designed to stealth out the rootkit.
Not that I can get to the article ("Error establishing a database connection"), so I have no idea if that's the case, but it seems quite possible to me that if it's a rootkit, it's actively hiding from detection, which would seem to let Microsoft off the hook. Except for however the rootkit infected the machine in the first place.

--
You are in a maze of twisty little relative jumps, all alike.
Re:Ah, well, that lets Microsoft off the hook then by PIBM · 2010-02-12 05:46 · Score: 2, Insightful

Scanning it does not even guarantee the detection of the root kit. I can see tons of useless scans a user could run ;)
Re:Ah, well, that lets Microsoft off the hook then by ozmanjusri · 2010-02-12 05:48 · Score: 2, Insightful

Im going to go with the user.
Of course.
They're the ones who paid for an OS that's about as secure as a colander, after all.

--
"I've got more toys than Teruhisa Kitahara."
Re:Ah, well, that lets Microsoft off the hook then by Sockatume · 2010-02-12 05:59 · Score: 2, Interesting

I'm not sure it'd be such a pain. Windows already demands to restart after critical updates anyway. Couldn't it throw a flag to boot from a secondary, encrypted, trusted "update partition" that only the Windows root can edit, and only during shutdown, then use that to mount the disk as read-only and install updates? You could call it Microsoft SafeUpdate, part of the Trusted Computing Initiative. Heck, make the secondary partition an SSD, give the hardware manufacturers a reason to get behind it.

--
No kidding!!! What do you say at this point?
Re:Ah, well, that lets Microsoft off the hook then by jhoegl · 2010-02-12 06:03 · Score: 2, Informative

That is BS and you know it.
The user installed the virus into their system by doing something stupid.
Its like blaming the US Government for letting businesses go over sea when you still shop at Walmart.

Your response is a cop out.
Re:Ah, well, that lets Microsoft off the hook then by spun · 2010-02-12 06:12 · Score: 4, Insightful

That is BS and you know it.
The user installed the virus into their system by doing something stupid.
Its like blaming the US Government for letting businesses go over sea when you still shop at Walmart.
Your response is a cop out.
Your response is what is commonly known as 'blaming the victim.' Seriously, you can't imagine any other way for malware to get onto a system except user stupidity? I'd call that a failure on your part. You know, Windows fanbois remind me of battered women, explaining to others how they walked into a door or fell down some stairs. No you didn't, you let somebody beat the shit out of you and then covered it up.

--
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
Re:Ah, well, that lets Microsoft off the hook then by RoFLKOPTr · 2010-02-12 06:13 · Score: 2, Interesting

I'm not sure it'd be such a pain. Windows already demands to restart after critical updates anyway. Couldn't it throw a flag to boot from a secondary, encrypted, trusted "update partition" that only the Windows root can edit, and only during shutdown, then use that to mount the disk as read-only and install updates? You could call it Microsoft SafeUpdate, part of the Trusted Computing Initiative. Heck, make the secondary partition an SSD, give the hardware manufacturers a reason to get behind it.
RootKit() {
if ( RecoveryPartitionPresent() == 1 ) {
WriteRandomShit(RecoveryPartition);
}
}
Re:Ah, well, that lets Microsoft off the hook then by TheLink · 2010-02-12 06:16 · Score: 4, Insightful

> Saying Microsoft is responsible for ensuring compatability with 3rd party software is ludicrious.

And saying Microsoft is responsible for ensuring compatibility with _malicious_ 3rd party software is even sillier.

If your system is screwed up by a rootkit, there is no way to 100% predict what could happen if you try to continue using it (including trying to install patches).

If the BSODs are only happening to rootkitted XP boxes then it's clearly not Microsoft's fault.
--
- Too many replies beneath your current threshold
Re:Ah, well, that lets Microsoft off the hook then by Tuidjy · 2010-02-12 06:19 · Score: 3, Insightful

You know, it is far from easy to implement a "secondary, encrypted, trusted "update partition" that only the Windows root can edit, and only during shutdown" on a PC that has been rooted, unless you support this in hardware. And I can already hear the screaming and gnashing of teeth if some people, present company very much included, learned that PCs come with something like that.
I would certainly not be happy running hardware that I knew had something that I and no one I know could get into. And I can get into it, it's not that "trusted", is it?

--
No good deed goes unpunished...
Re:Ah, well, that lets Microsoft off the hook then by svtdragon · 2010-02-12 06:38 · Score: 4, Informative

Or you don't pay for the OS, and you don't have to pay for antivirus.

Isn't free software great?
Re:Ah, well, that lets Microsoft off the hook then by Opportunist · 2010-02-12 06:49 · Score: 4, Insightful

As much as I hate defending MS, I can't help but doing it here.
A rootkit (and that is one) in a system means that you, being software running on that system, have no chance of detecting it, at least if it has done its homework. For the patcher, those checksums might even have been correct.
It also needn't be manipulated files. Windows, as any OS that has to allow low level drivers, allows you to load non-MS ring0 drivers. Like, say, Linux. It's either that or writing a device driver for every single pesky little controller out there. Do you think MS would do that? Or even do it well?
Now, you don't need drivers for hard drives themselves, but for their controllers. And spyware is quite keen on snuggling up to those controller and "filtering" the calls between them and the OS. Now, those spyware drivers are deemed part of the I/O system (for obvious reasons, they are part of the HD controller drivers as far the OS is concerned). If that driver cannot be loaded because that patch fixes a loophole the spyware used, the OS identifies that as a critical error in the HD controller driver and cannot access the hard drive anymore. BSOD.
The very same would probably happen in Linux, in BSD, in ... whatever Apple's OS is called, I forgot. You have a driver that is deemed critical by the system that fails to load.
If you want to blame anything on MS here, it's probably that this rootkit drivers could be installed in the first place. And I honestly don't know if it's MS to blame or the user. What should MS do if the user clicks "allow" on anything he gets asked? Take away control from the user? I doubt you'd like that.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:Ah, well, that lets Microsoft off the hook then by Opportunist · 2010-02-12 07:04 · Score: 3, Informative

You can do it, but it's basically worthless if your system has been infected with a rootkit. The rootkit can (and usually does) show you a perfectly healthy system instead of the reality on the drive. As has been said before, the rootkit probably keeps a copy of the original file somewhere and only "shows" it to you in its original place (where now that rootkit file is located). It doesn't usually affect its operation, since it has already been loaded and unless it needs more data from its file (unlikely), nothing bad happens from the fact that the file that is loaded differs from the file that is shown on the disc.
If you now try to calculate a MD5 from the file on the disc, you will be supplied the original copy (that was replaced by the rootkit) and calculate your MD5 from the healthy file, making it appear a_ok and fine.
Once a system has been rooted you have lost. I hate to use the same words I always get to hear from consultants, but here they fit: You cannot identify some problems from within the system.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:Ah, well, that lets Microsoft off the hook then by Opportunist · 2010-02-12 07:17 · Score: 4, Insightful

Over 90% of current infections are due to social engineering (aka "user stupidity"). The rest is usually due to certain third party software from a company with a big A, usually a certain reader for a Pretty Dumb Format or a tool to make webpages flashy.
If it's blaming the victim to say that it's effing stupid to open attachments that are sent by "Lawyer" and titled "last reminder" or run "security patches" their bank sends them because else their account is closed immediately, then yes, I blame the victim. Stupidity is no excuse. And this behaviour is, bluntly, EFFING stupid!

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:Ah, well, that lets Microsoft off the hook then by V!NCENT · 2010-02-12 07:19 · Score: 2, Insightful

Do you?

--
Here be signatures
Re:Ah, well, that lets Microsoft off the hook then by rarel · 2010-02-12 07:26 · Score: 2, Funny

I have a scanner, it's an Epson something. Doesn't do a damn thing, always gives me just a picture. These things are such a ripoff... :/
Re:Ah, well, that lets Microsoft off the hook then by plague3106 · 2010-02-12 07:44 · Score: 2, Insightful

You pay with your time having to support the damned thing. Yup, I left linux because it was too much trouble keeping it going and I wasn't able to get done what I actually wanted to get done. I now happily pay for Windows, and have never had a virus.
Re:Ah, well, that lets Microsoft off the hook then by Opportunist · 2010-02-12 08:14 · Score: 2, Insightful

The only data I have on this matter is still under an NDA, so I can as well have none. But you are invited to draw your own sample. Take every infector you can get your hands on and check what way they use to get onto the machine.
And yes, 90% is not 100%. Still it means that the chance to be infected provided you know what you're doing is 1/10th of that if you don't. While this does not immediately translate to 9 out of 10 infected machines being infected because the user sitting in front of it is unable to defend against social engineering infection routes, it still means that you are about ten times as likely to catch something if you are not able to use your computer in a safe way.
There's a story in the firehose currently about an interesting incident that showcases the problem quite well. A blogging page had a huge problem: They appeared as the first Google search result for "facebook login". The result was stunning! Their comment section was swamped by angry people complaining that they cannot log into their facebook account. They did not check the URL, the did not even bother realizing that the webpage looks completely different.
Could you see how a malicious attacker could try to get the first spot for search terms containing paypal or amazon, and set up a fake page there to lure people into logging in?
Yet again, I would call it user stupidity if this happens. Or rather, the inability to use the tools sensibly. Getting conned even if you're smart and cautious because someone is smarter is one thing. Getting conned because you're using something and have not the foggiest idea what you're doing is something completely different.

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Re:Ah, well, that lets Microsoft off the hook then by Z34107 · 2010-02-12 08:15 · Score: 2, Informative

My sentence immediately following your quote:

(Of course, the rootkit will have the opportunity to hide itself or destroy your tool.)

In my experience at my campus' help desk, the TDSS rootkit hasn't been sophisticated enough to hide from RootkitRevealer, ComboFix, or MalwareBytes.
We generally find it with one of the "XP Antivirus 2010" variants, and when they come together TDSS seems to reinstall the scareware payload. In those cases, it's especially obvious when it's been removed - the "you've been infected" pop-ups go away.
I don't disagree with you, but 90% of the time a 10 minute ComboFix scan removes it. The only way to be sure is diskpart clean all (or dd /dev/zero /dev/hda) from a WinPE or Linux boot disc.

--
DATABASE WOW WOW
Re:Ah, well, that lets Microsoft off the hook then by Z34107 · 2010-02-12 08:42 · Score: 2, Insightful

A Windows PE disc (meaning any Server 2008/Vista or newer Windows disc) is very nice for this. Shift+F10 will bring a command prompt; bootsect will let you restore an XP or Vista boot sector.
Chkdsk breaks a lot of rootkits - they break the file system and chkdsk removes them.
Another fun trick: Make an image of the disk with ImageX from the Windows AIK. Then immediately restore the image onto your disk. ImageX is file based, and the rootkits do their best to hide, so they're missed when the image is gathered.
But by that point, it's faster/safter to do a clean install Q.Q

--
DATABASE WOW WOW

SFC Find It? by ircmaxell · 2010-02-12 05:34 · Score: 2, Insightful

Will the windows SFC (System File Checker) tool find this altered file?

--
If a man isn't willing to take some risk for his opinions, either his opinions are no good or he's no good

Re:SFC Find It? by RayMarron · 2010-02-12 05:48 · Score: 2, Informative

Not if the rootkit responds to the request with the original values for the files it has replaced. That's the the thing about a rootkit - it gets to tell the OS whatever it wants.

--
ON DELETE CASCADE
Re:SFC Find It? by omgwtfroflbbqwasd · 2010-02-12 05:59 · Score: 2, Informative

Generally, rootkits will modify function pointers in the kernel so that typical detection activities are trapped and handled so that the system appears unaltered. In the case of file access, the original file (in an alternate location, data stream, etc.) can be accessed in place of the trojaned one that was loaded on boot, thus preserving original the file size and contents.

No surprise if true by al0ha · 2010-02-12 05:42 · Score: 5, Interesting

I've performed a forensic analysis on numerous Windows machines and have discovered rootkits that have lived on machines undetected for up to two years even though they were up to date on patches and AntiVirus defs. In fact one of the rootkits was unknown until I discovered it and sent a copy to threatexpert and virustotal.

--
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ

Re:No surprise if true by JumpDrive · 2010-02-12 05:47 · Score: 2

Can you give us a little more information on how you discovered these rootkits?
Re:No surprise if true by The+MAZZTer · 2010-02-12 05:57 · Score: 5, Informative

If you compare a file listing run from inside the machine to one run from a bootable CD OS where the rootkit can't load, different files are a dead giveaway that something is being hidden, and a rootkit can't work around this.
There are also lower level APIs one can use inside of an OS that are much harder for a rootkit to patch so such tools can also locate some rootkits without needing to boot from CD. See: RootkitRevealer
Re:No surprise if true by hoggoth · 2010-02-12 06:21 · Score: 4, Informative

No, he's suggesting a program that runs first under Windows to make a list of every file on the disk along with a checksum, then runs under Linux to make a list of every file on the disk along with a checksum. If the lists differ there is likely a root-kit hiding itself when running Windows.

--
- For the complete works of Shakespeare: cat /dev/random (may take some time)
Re:No surprise if true by Lifyre · 2010-02-12 06:30 · Score: 4, Interesting

Is there currently a set of programs that does this in some automated fashion that will generate a list of discrepencies to parse through?

--
I'll meet you at the intersection of "Should be" and "Reality"
Re:No surprise if true by hoggoth · 2010-02-12 07:55 · Score: 3, Informative

Off the top of my head, without checking my syntax, do this:
find / -exec md5sum -b {} \; > filelist-win.txt
find / -exec md5sum -b {} \; > filelist-lin.txt
(find scans all the files from / down, running md5sum on each one)
Run each under Windows and Linux, respectively. On Windows you will need 'find' and 'md5sum' for Windows, or Cygwin for a full Linux subsystem.
diff filelist-win.txt filelist-lin.txt

--
- For the complete works of Shakespeare: cat /dev/random (may take some time)
Re:No surprise if true by vmxeo · 2010-02-12 09:02 · Score: 4, Informative

Is there currently a set of programs that does this in some automated fashion that will generate a list of discrepencies to parse through?
I believe RootkitRevealer does, although it does it by comparing the files as shown through Windows to a raw read of the file table.

--
Shameless plug for my photos on Flickr

Re:mirror please? by n0tWorthy · 2010-02-12 05:43 · Score: 3, Informative

I just happen to have it open in another window:

Microsoft Update KB977165 triggering widespread BSOD One of Microsoft's "Patch Tuesday" security fixes is triggering a widespread "Blue Screen of Death" problem. The cause is not the update itself, but an existing infection. So far, reports suggest that this problem affects Windows XP and Windows Vista. Once the update is applied and the system rebooted, Windows will bluescreen at boot. When booted to Safe Mode, the system will freeze. Removing the update from the Windows Recovery Console or using live media will get the system booting again, at least until the update is reapplied. I have found that the root cause is an infection of %System32\drivers\atapi.sys, and that replacing this file with a clean version will get the system booting normally. This is not the first time that an infection hitting atapi.sys has caused updates to trigger bluescreens. If you are running Windows and have not yet applied this update, make sure you scan your computer thoroughly for infections before applying this update. If you are experiencing this problem, get your computer to a professional that can replace the infected atapi.sys and clean any other malware from your computer. References: http://isc.sans.org/diary.html?storyid=8209 http://social.answers.microsoft.com/Forums/en-US/vistawu/thread/73cea559-ebbd-4274-96bc-e292b69f2fd1 Detailed Repair Instructions Using the Windows XP Recovery Console 1. Boot from your Windows installation CD Insert your Windows installation CD and boot your computer. If your computer is not set to boot from CD first, you may need to reconfigure your BIOS or press a boot menu key (often F12, F8 or Esc). If you are unsure of how to do this, consult your favorite geek. As soon as the boot starts, you should see a message like "Press any key to boot from CD..." - press a key. 2. Start the Recovery Console After the CD loads (it may take a minute), you will be presented with a few choices. One of these options is to start a recovery by pressing "R". Press "R" to launch the Recovery Console. * You may be asked to choose a Windows installation. If so, choose the damaged installation (probably "1). * You may be prompted for the Administrator password. If you do not have one, press "Enter". 3. Identify your CD drive letter You should now be at the command prompt. Enter the following command: map Look for the drive letter for your CD drive. It may look something like this: D: \Device\CdRom0 In this case, your CD drive is "D:". 4. Replace ATAPI.SYS Enter the following, replacing "D:" with your CD drive: cd system32\drivers ren atapi.sys atapi.old expand D:\i386\atapi.sy_ You should see the message "1 file(s) expanded." - this indicates you have succeeded. 5. Reboot and scan for malware Reboot your computer. With a little luck, your computer will now boot normally. Because this problem is caused by malware, you should immediately scan your computer with up-to-date antivirus software. Tags: Malware, Security, Windows This entry was posted on Thursday, February 11th, 2010 at 17:22 and is filed under Security. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.

--
"Be kind, for everyone you meet is facing a great battle." - Philo of Alexandria -

had one yesterday by Revek · 2010-02-12 05:45 · Score: 2, Informative

Scanned the drive in another machine and it detected atapi.sys as having a trojan. I restored it from /i386 and it came right up. I never thought it was connectd with the xp problems. Microsoft didn't do a evil thing who would have knew.

Re:mirror please? by n0tWorthy · 2010-02-12 05:45 · Score: 3, Informative

And some other salient responses:

Michael Bristow says:
2010-02-12 at 11:48
I had a machine come across my bench with this issue, first thing Wednesday morning. One of the first things I tried was running SFC form an ERD boot disk. it replaced several files including atapi.sys, but was still would not boot. only way to get the PC back up and running was to remove the patch.

Multiple scans, with no infection detected, and I tried re-installing the patch, only to get right back to Blue Screens.

In short, there is obviously more going on than just a problem with infected atapi.sys files.

Jim Blizzard says:
2010-02-12 at 12:00
Very nice work Patrick,

We have seen this occur on a few machines at the FAA so I wrote a vbscript to loop through an .xls of machines and record the MD5 Checksum. Thought it may come in handy for yourself and some of your readers..

http://home.comcast.net/~jblizz/Atapi_MD5_Checker.zip

--
"Be kind, for everyone you meet is facing a great battle." - Philo of Alexandria -

Inadequate regression testing by Ralish · 2010-02-12 05:51 · Score: 5, Funny

Next time you might consider doing some backwards compatibility testing with popular rootkits, yes? Just a free tip Microsoft!

Re:Inadequate regression testing by shutdown+-p+now · 2010-02-12 06:03 · Score: 4, Funny

Next time you might consider doing some backwards compatibility testing with popular rootkits, yes? Just a free tip Microsoft!
But if we do, the makers of less-popular rootkits could sue us in EU for monopolistic preferential treatment! ~

VirusTotal by z4ns4stu · 2010-02-12 05:55 · Score: 2, Informative

Here's a link to the report from VirusTotal when you upload an infected atapi.sys.

http://www.virustotal.com/analisis/85aa49f587f69f30560f02151af2900f3dc71d39d1357727ab41b11ef828a7ff-1265925529

--
The whole moon and the entire sky are reflected in one dewdrop on the grass. - Dogen

Sounds like a House-style diagnosis by msbmsb · 2010-02-12 06:04 · Score: 2, Interesting

Apply this patch to see if the machine is infected by some seemingly-unrelated rootkit.

"It's not a bug, it's a feature" by davidwr · 2010-02-12 06:08 · Score: 3, Funny

"Yes, our security update crashed your computer. We hope you enjoyed our anti-rootkit feature."

--
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.

Remove it with ComboFix by cyprezzz · 2010-02-12 06:11 · Score: 5, Informative

I've seen this Tdss-rootkit on many machines. Usually it infects a disk driver like atapi.sys or iastor.sys. Typically an infected machine will boot in normal mode, but NOT in safe mode (blue screens). If Windows will boot, running ComboFix has removed the rootkit for me every time. The author of ComboFix is a genius.

Re:Remove it with ComboFix by maxume · 2010-02-12 07:00 · Score: 2, Informative

Do note that it is simply a self extracting archive containing a batch file and some other tools (and it isn't clear that the tools have been licensed for redistribution).
WinRar and 7-Zip can both extract the file, the main program is 'C.bat'. It contains this entertaining text:

:: It's okay if you want to take a peek at the script but ...... :: please bear in mind that if you have to copy, that means you can't script it on your own. :: Copying means you don't understand enough. Also means you're not ready to make tools. :: Do yourself & everybody else a favor. Don't release anything that you dont fully understand. :: Chances of trashing a machine is high. Bide your time. If you work hard, your time shall come.
I've also seen it where the 'helpers' on malware sites say that they don't want to reveal how (their batch script) works, as it would help the malware writers (you know, the guys writing low level rootkits).
It also seems to use the 'probably won't break anything' approach to testing.
Definitely a buyer beware type of situation (but it has been used to help loads of people...).

--
Nerd rage is the funniest rage.
Re:Remove it with ComboFix by Kremit · 2010-02-12 07:18 · Score: 2, Informative

The TDSS rootkit (not sure how many variants do this...) installs itself as a Non-Plug-and-Play device driver. You can often remove the head of the rootkit by going to System Properties => Device Manager => View menu => Show hidden devices Then, click the + sign next to Non-Plug-and-Play devices. If there is a "TDSS*" device, you can delete it. I was able to recover a machine by doing this, then scanning for viruses. Obviously it's best to scan the hard disk externally or wipe the whole machine, but that might help someone in a pinch.

At rainbow's end: Win32/Alureon.A detected by westlake · 2010-02-12 06:16 · Score: 5, Informative

After all, there's no way that their malware tool could have spotted it, or the update could have checksummed the files before patching them.

If they put half as much effort into their anti-malware activities as they do into their DRM regime, the world would be a better place. We'd all have unicorns, and a pot of gold.

Microsoft does detect it - and has since last October.

File atapi.sys received on 2010.02.11 21:58:49 (UTC)

Virus:Win32/Alureon.A
Updated: Dec 07, 2009

Aliases:

Win32/Olmarik!generic (CA) Rootkit.Win32.TDSS.u (Kaspersky)
W32/TDSS.drv.gen4.A (Norman)
Mal/TDSSPack-V (Sophos)

Encyclopedia entry

Updated: Dec 07, 2009 | Published: Dec 02, 2009

Aliases

Win32/Olmarik!generic (CA) Rootkit.Win32.TDSS.u (Kaspersky)
W32/TDSS.drv.gen4.A (Norman)
Mal/TDSSPack-V (Sophos)

Alert Level
Severe

Detection initially created:
Definition: 1.69.77.0
Released: Oct 23, 2009

There are no common symptoms associated with this threat. Alert notifications from installed antivirus software may be the only symptom(s). When the infecting trojan is run, it infects a system driver, usually 'atapi.sys'. It has also been observed to infect 'iastor.sys' but other system drivers may also be targeted. The system driver detected as Virus:Win32/Alureon.A is infected by the addition of code, whose function is to load a part of the Alureon rootkit. The Alureon rootkit is a component that gives Alureon the ability to avoid detection; it is created by the same Alureon trojan that infects the system driver. The rootkit loaded by Virus:Win32/Alureon.A has the ability to avoid behavior blockers, which allows it to perform its malicious routines uninterrupted. It can also hide files and disk sectors.

Manual removal is not recommended for this threat. To detect and remove this threat and other malicious software that may have been installed, run a full-system scan with an up-to-date antivirus product such as Microsoft Security Essentials... . Win32/Alureon may modify DNS settings on the host computer, thus the following steps may be required after the Win32/Alureon removal is complete:
If the computer has a network interface that does not receive a configuration using DHCP, reset the DNS configuration if necessary

ATAPI.SYS Infections by nlewis · 2010-02-12 06:24 · Score: 5, Informative

I run a small computer repair shop, and we first started seeing this ATAPI.SYS virus a few weeks ago. When I would submit it to VirusTotal, it would always come back as clean on every single virus scanning engine - but I could tell it was infected. I even had a computer in here just yesterday which had the infected ATAPI.SYS file, yet it was not detected as such - even when the hard drive was mounted as a secondary drive in another system and scanned with several up-to-date antivirus programs.

The virus itself is actually quite a clever little beast. After infecting the file, it sets the file modification time back to the original date & time, which makes it hard to tell that it's been modified. Also, I've noticed that the byte counts between infected and non-infected versions of the file are almost always identical. But to do that, it appears to be injecting its code into the area normally used to store the file version information. The upshot is, if you check the file properties and there's no file version information (the Version tab under XP or the Details tab under Vista/Win7), there's a good chance the file is infected.

I have not had any computers come in to the shop with the BSOD mentioned in the articles yet, but I'm expecting them at any time...

"Rootkit May Be Behind Windows Blue Screen" by thatskinnyguy · 2010-02-12 06:26 · Score: 4, Funny

Rootkit? I don't see it. Maybe it's because this damn blue screen is blocking my view.

--
The game.

Re:That does not matter. by Anonymous Coward · 2010-02-12 06:40 · Score: 2, Insightful

The issue appears to be the result of an infected driver relying on some internal bits of the kernel that were patched. It's actually the author of the software that infected the driver that's causing the problem.

The infected driver was _NOT_ part of the Windows update and the update had no dependency on that driver.

This is not Microsoft's fault.

While I'm all for free speech, I do prefer that the speaker have some soft of expertise on the topic.

Re:That does not matter. by Cl1mh4224rd · 2010-02-12 06:41 · Score: 4, Interesting

Yes, this was from a virus/trojan/worm/whatever. Who cares? It could just as easily have been a custom file for custom hardware.

You don't know how rootkits work, do you?

It may not be possible to detect differences in a compromised file on a rooted system, because the rootkit will respond to requests with the original file's information.

So, for all we know, Microsoft did check the file before replacing it, but the rootkit told the OS it was unmodified.

--
People will pass up steak once a week, for crap every day.

Re:M$ at root of problem...but wont admit by e2d2 · 2010-02-12 06:43 · Score: 2, Insightful

Do you have any evidence or are you just spouting off bullshit? No need to answer, it's a rhetorical question.

Seriously though, guys/girls like yourself need to get a fucking grip. When you say "M$" you sound like a tool. When you cry foul when there is none you sound like a tool. When you make baseless accusations against someone because they are trying to inform people of a potential rootkit problem you sound like a tool.

Summary: You sound like a tool and people won't listen. So any future complaint or criticism, however legitimate, will simply be ignored.

How could one check for rootkits? by trytoguess · 2010-02-12 06:56 · Score: 2, Interesting

The comments here suggest ideally using a bootable CD to scan the drive, but what exactly should one use?

Re:How could one check for rootkits? by arndawg · 2010-02-12 07:19 · Score: 2, Informative

Avira has an okay livecd you could use.

Re:That does not matter. by anamin · 2010-02-12 06:59 · Score: 2, Insightful

And what happens when the rootkit bypasses the operating system access to that file and returns the expected results? This is a rootkit after all.

Re:That does not matter. by Opportunist · 2010-02-12 07:11 · Score: 2, Insightful

And HOW exactly should they check if the system has been infected by a rootkit that shows the patcher a file that matches the checksum?

--
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.

Re:MOD PARENT UP by nschubach · 2010-02-12 07:25 · Score: 2, Funny

AC's don't get mod points! ;)

--
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.

Re:That does not matter. by V!NCENT · 2010-02-12 07:25 · Score: 3, Insightful

Checksums, 'nuff said...

Apps: Calc this for me...

rootkit: errrrrr.... ?

Apps: Busted, fscker! *and warns user*.

--
Here be signatures

Re:That does not matter. by MarcQuadra · 2010-02-12 07:44 · Score: 3, Insightful

Won't work. To take your analogy a bit farther...

The thief is the rootkit, you're the kernel, and the patch is the police.

The thief is already in, hiding behind the sofa with a gun pointed at your head. The officer knocks on your door and asks if you're being robbed. The answer is 'no'.

A rootkit can invade the lowest-level of the Virtual File System, so when a patcher running in user space asks for the checksum of the file it's about to patch, it gets a 'clean' result, even if the -real- file on the disk is something entirely different.

There are a lot of misconceptions about what rootkits really are. I encourage anyone to take a few hits of LSD and explain physics to me, or perform surgery on themselves while under the influence, that's about the closest thing I can compare to patching or rootkit detection on a system that's already compromised.

--
"Sometimes, I think Trent just needs a cup of hot chocolate and a blankie." -Tori Amos on Nine Inch Nails

Re:Ways to alleviate this problem... by VTBlue · 2010-02-12 08:35 · Score: 2, Interesting

//Microsoft Employee here//

Check out Microsoft Security Essentials if you work with customers computers.

http://www.microsoft.com/Security_Essentials/

It is 100% free and has gotten favorable reviews. It is also very minimalist in design and simple to understand by non-technical people.

http://www.pcmag.com/article2/0,2817,2353447,00.asp

Re:I'm in favor of requiring Internet User's Licen by hairyfeet · 2010-02-12 08:41 · Score: 2, Insightful

Because ANY law WILL be abused, full stop. You make it so everyone has to have an "Internet License" and no longer can posts anon, you know what you will get? "Oh you posted something mean! don't you remember the Myspace suicide girl? No net for you!" "How dare you speak out against dear leader! Don't you support our troops? No net for you!"

If you passed crap like that pretty soon the entire net would be nothing but the Home Shopping network. "Gee isn't product X swell? It sure is Biff!" because you won't dare say anything that could get your driver's license revoked. The problem with comparing the Internet to IRL is that it isn't real folks. It is easy to show some guy had a BAC equal to falling down drunk and was doing 80 in a 30 and needs his license revoked.

But with the Internet the "rules" would end up getting written by politicians pandering to the PC police and every interest group with a checkbook. The "think of teh childrenz!" groups alone would try to turn everything into Mr. Rogers while the bible thumpers would want everything to be Jesusland, and of course the Scientology nuts would have your license for daring to even THINK the word Xenu. yeah, no thanks, I'll stick with what we got now, thanks anyway. I haven't seen a bug since 98, and working PC repair I can say you just can't fix stupid.

--
ACs don't waste your time replying, your posts are never seen by me.

Slashdot Mirror

Rootkit May Be Behind Windows Blue Screen

68 of 323 comments (clear)