Slashdot Mirror
Rootkit Infection Requires Windows Reinstall
CWmike writes "Microsoft is telling Windows users that they'll have to reinstall the OS if they get infected with a new rootkit. A new variant of a Trojan Microsoft calls Popureb digs so deeply into the system that the only way to eradicate it is to return Windows to its out-of-the-box configuration, Chun Feng, an engineer with the Microsoft Malware Protection Center (MMPC), said last week on the group's blog. 'If your system does get infected with Trojan:Win32/Popureb.E, we advise you to fix the MBR and then use a recovery CD to restore your system to a pre-infected state,' said Feng. A recovery disc returns Windows to its factory settings."
um.... Why not just use a boot disc to clear the MBR/infected files?
You always do an OSRI if you get infected by any rootkit.
I had a nasty infection a while ago that corrupted my system restore points. I haven't had a problem like that since I upgraded to Vista or Windows 7.
Does this virus kill system restore too?
And before anyone makes any snarky comments about switching to Linux look at all the nasty software infecting Android phones right now.
Right advice, wrong OS.
make imaginary.friends COUNT=100 VISIBLE=false
IF you even find you have a rootkit, the only real solution is to throw out the whole machinel. Nuking from orbit is the only way to be sure - otherwise you'll find the virus flashed into your NIC boot ROM, or your VGA or motherboard BIOS.
I want to delete my account but Slashdot doesn't allow it.
The only way a machine can be trusted after ANY infection is an OS reinstall.
Or as ripley said - nuke it from orbit, its the only way to be sure.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
I hear the ocean's kinda deep in places.
We all need a major re-think of how OS is installed on the computer, how it is architected, etc.
Seems to me that a low-level kernel in FLASH, which can only be upgraded with a hardware key inserted (e.g., the kernel FLASH blocks can only be written when there is a physical device plugged into the system), which then supports a number of different OS images using virtual machine concept, is the way to go. I the image of any VM gets rooted, you just toss it and revert to last backup. The flash is immune to tricks, because you must insert a hardware key to upgrade it, so trojans could not over-write the FLASH-based kernel, the worst that can happen is that one of the OS images get corrupted, then you just revert to saved.
Do all Windows PCs ship with a CD? What about retrieving the user's data?
Is Sony getting back at us for bashing them over the last month or so??
Huh?
A recovery disk will restore your computer to the state it was in when the recovery disk was created. For me, this means that I can always go back to a recovery image made at 3am each and every day and stored off site. While I don't specifically plan on getting infected with a rootkit any time soon, I do plan for the worst.
All this blog entry says is that if you are infected with this rootkit you need to fix your MBR before you restore an image of your system.
You work for Symantec?... use ntfsclone or partimage from a live CD instead
For justice, we must go to Don Corleone
When the fuck did AV software stop scanning the boot sector?
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Hmm, the MS Blog doesn't say you need to do an OS reinstall; only replace the MBR with a clean one; then do a system restore to a point in time PRIOR to the infection - entirely different to a reinstall
Free offer of recovery CDs for Windows users: http://www.ubuntu.com/download/ubuntu/download
So they get to choose between a system that is unusable from malware or a system that is unusable because it won't run their Windows applications?
The Microsoft engineer is quoted as saying, "restore your system to a pre-infected state". The article then says, "a recovery disc returns Windows to its factory settings". This is entirely false. The engineer is not saying to do a factory restore. For the layman using 7: use F8 or a 7 disc and choose "repair your computer", run the command prompt, run fixmbr, run system recovery and go back a day.
But if I knew one of my systems is victim to a rootkit, I'd reinstall the OS without thinking twice - otherwise I'd be looking over my shoulder at every executable on that system until the end of time.
He was correct up to the point he said use a "recovery disk".
I recommend installation of a more secure OS. Default install of virtually any *nix OS will do.
This is different to most other root kits? I would still trash a machine if I found a root kit somewhere. You do not know what has been done or if it is really gone.
i had to read that last part twice. my eyesight gets bad the older i get
Hmmm, the company that has fought tooth and nail to remove all user access to recovery CDs because they might pirate or something now wants us to use them? Bwahahaha. Glad I gave up on Windows a long time ago. Life is better now, not to mention cheaper, faster, less annoying, and less worrisome.
I don't even use Windows, but I shudder to think about all the family computer I'll have to fix due to this shit.
All modern operating systems do it, right? I heard IOS locks itself in pretty good. For crying out loud - once you click "accept" to that first question, doesn't that imply you agree forever? C'mon bitch, where's your automatic update now?
This issue is a bit more complicated than you think.
Requires a system *restore* not *recovery* and fixmbr. SHOCKING. I do this multiple times a week in my role as a computer fix-it guy. Grandma can't afford to spend the cash to have her system reloaded just because some virus got in there. I've cleaned out some pretty nasty rootkits and virii that only took me a few minutes with a Linux boot CD and then fixmbr. It doesn't take long if you've done it a million times.
Nobodies Prefect
Tidbits for Techs Technology Blog
Viruses that infected the MBR and hid themselves by intercepting int13h have been around since at least the early 90's, if not earlier. A boot disk was an easy fix, and AV programs could always bypass BIOS and access the drive directly to find out what was really there.
The original blog posting says nothing about reinstalling windows. The fixmbr tool in the Recovery Console doesn't affect the operating system, and is the same old fix as it's always been. The CW article is a mix of FUD and ignorance.
Somebody needs to get tough and track a few of these malware authors down and start breaking their knees, sticking hot soldering irons in their eyes, cutting their hands off, etc...
Wouldn't be long until people would be too scared to even dream about writing malware.
Simply boot from another OS. Knoppix is an excellent choice: it can read/write NTFS partitions, and provides you with a nice GUI to move/rename/delete files.
This is my method of choice for removing Windows viruses.
The final step for this virus would be to afterwards use the `fixmbr` tool.
Piece of cake. No reformatting necessary.
/dev/random
If you read the TFA's FBE (F-ing Blog Entry), you'll find that you just use a recovery console, run FIXMBR, and then run a system restore to a date before your system became infected.
Hardly intractable. Not a reinstall. If it goes unnoticed for a very long time, you might not have a restore point early enough, but that goes for any malware.
People still use Windows?
RTFA.
the technow blog never says you need to reinstall. It says you need to restore the MBR with the recovery console and restore the OS. This can be a system restore point recovered by using the recovery CD. The only reason you need a recovery CD is to avoid booting the system while its still loading the infected disk driver
I mean, the fact they don't give recovery CD's anymore. Oh, I'm sure a couple of manufacturers do, maybe on a few models, but really don't give out Windows recovery disk anymore.
The preceding post was not a Slashvertisement.
By far the best tool ive ever seen to deal with a rootkit infection is ComboFix. It uses a process I can only describe as black magic to eradicate it. Use at your own risk though.
So they get to choose between a system that is unusable from malware or a system that is unusable because it won't run their Windows applications?
Oh, quit whining and start WINEing.
Help! Help! I'm being repressed!
Who has them? MS has pushed not shipping them for so many years. Too bad they don't do the right thing, and make install ISO's available with latest patches for XP / Vista / 7
Hey, it's got a web browser, and email, so it's already more productive than the malware infected machine.
+1
Ghost is great for Windows only.
Add an ext4 partition and/or GRUB and it all goes to hell.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
In what is probably not the world's best news for Symantec, even Microsoft has gotten around to developing a Windows imaging tool that(mostly) works. The "Windows Automated Installation Kit" is something of a baroque monstrosity; but it exists and is offered at no additional cost to Windows customers.
It took 20 years and alarming complexity increases; but it's almost like being able to tar your OS install and then untar it onto a newly created filesystem!
And you don't seem to know that punctuation goes inside quotations. Sentence capitalization not withstanding.
The eternal struggle of good vs. evil begins within one's self.
Anyone who believes this, much less preaches it, is an absolute moron. There are vulnerabilities in any working system. There always have been and there always will be. Consumer distributions of Linux might not have the same holes that Windows has, but that doesnt mean there are none. It may be harder to achieve process escalation, but that doesnt mean its impossible. After all, a dumb user is still the weakest link in a security system.
In other news, Geek Squad continues business as usual.
So what hole is this infection initially exploiting to be system resident? A genuine unknown security vulnerability in Windows and IE, or a secondary attack through 3rd party software or add-ins? Is a fully patched Windows system w/ either MAV or 3rd party AV like Sophos or Kaspersky, and users running with non-Admin privileges still at risk? I'm going to assume yes here!
Yes, I read MS blog and only after checking the Popureb.B variant does it only reference I.E. slightly.
This was detected on June 21. It's been a week. For something this serious, and to the vast resources that MS has at their disposal, why is the IT community still in the dark, and just how much of a priority does a Microsoft put on this kind of end user breach?
It's a trojan, loaded onto systems by users giving root access to suspect software. This is the most common attack vector in use today. What on earth made you go straight to it being a security vulnerability? There's no "breach". There's nothing serious and no-one in the dark (except you, perhaps). It's simply a trojan. Fully patched systems are not "vulnerable" to this attack vector. Stupid users are vulnerable to it.
Best way to avoid it? Don't install pirated software, "free porn video codecs", or anything with a year in its domain name. And take your ritalin.
That'll clear the bootsector (good job, I've been using RC's commands to 'knockout' rootkits for years too per -> )You need to use RC's:
LISTSVC - shows all drivers names & states
DISABLE - stops services AND drivers
commands to finish it off, & this SHOULD do it!
(That's because it uses a driver - issues listsvc & it will show all driver names. Then use DISABLE to stop said BAD MBR bootsector protecting driver from loading, period!)
Proof thererof on WHY those 2 commands should work, hopefully & that this thing uses a protective driver:
---
http://blogs.technet.com/b/mmpc/archive/2011/06/22/don-t-write-it-read-it-instead.aspx
PERTINENT QUOTE/EXCERPT:
"now it introduces a driver component to prevent the malicious MBR and other malicious data stored as disk sectors from being changed. The driver component protects the data in an unusual way â" by hooking the DriverStartIo routine in a hard disk port driver (for example, atapi.sys)"
---
(Doing a listsvc /? or disable /? shows their paramter switches for their commandlines)
* ... & there you are!
APK
P.S.=> I've been using Recovery Console's (RC) commands for ages, since early Windows 2000 days for PC Security, & I list using it like mad for removal of even rootkits here:
http://www.proprofs.com/forums/index.php?showtopic=14264 & especially vs. rootkits as shown in that malware removal guide I wrote back in 2008 (first I wrote was 2001 for NeoWin & NTCompatible here http://www.neowin.net/news/apk-a-to-z-internet-speedup--security-text ).
RC/Recovery Console's great - it works & especially vs. rootkits
(& is pretty much as easy to use as DOS was. Very similar!)
So, you're correct on RC's FIXMBR being able to "blowout" a bootsector virus, but this one's trickier because of the driver being resident protecting the "BAD MBR"!
However - this SHOULD work to make SURE it's "blown out" & completely by not only cleaning the bootsector, but also disabling this bogus driver from loading too, if needed (sounds like it is needed - I only skimmed the articles, too late here for me to stay up reading more...)
So, since I must call it an evening? Well... if you guys find out anything else, like it's been modified even more to stop those commands of LISTSVC/DISABLE from running? Let me know... thanks, I'll catch it in the a.m. with coffee!
... apk
MS had the same advice in the wake of Nimda.
And, it may be one that needs tools only found in RC, check it:
http://tech.slashdot.org/comments.pl?sid=2275150&cid=36593272
Due to this thing protecting the MBR using drivers... fixmbr will blow out the bootsector in Windows Recovery Console, but to be ABSOLUTELY sure, the ListSvc & Disable commands will show the drivers loading & you can take them out as well!
APK
P.S.=> I don't believe you can do this from a Linux bootup with NTFS5 read/write, in disabling Windows drivers - that is, unless you guys know diff. that is - thanks for telling me IF there is a way in Linux to do that (would need Windows Registry read/write access & tools to write it properly too though)... apk
And, it may be one that needs tools only found in RC (recovery console in Windows install media), check it:
http://tech.slashdot.org/comments.pl?sid=2275150&cid=36593272
Due to this thing protecting the MBR using drivers... fixmbr will blow out the bootsector in Windows Recovery Console, but to be ABSOLUTELY sure, the ListSvc & Disable commands will show the drivers loading & you can take them out as well!
APK
P.S.=> I don't believe you can do this from a Linux bootup with NTFS5 read/write, in disabling Windows drivers - that is, unless you guys know diff. that is - thanks for telling me IF there is a way in Linux to do that (would need Windows Registry read/write access & tools to write it properly too though)
... apk
Assuming ghost works properly, which is a big assumption
Snowden and Manning are heroes.
It may needs 1 more command from RC (recovery console in Windows install media), check it:
http://tech.slashdot.org/comments.pl?sid=2275150&cid=36593272
Due to this thing protecting the MBR using drivers!
Yes, fixmbr will blow out the bootsector in Windows Recovery Console, but to be ABSOLUTELY sure, the ListSvc & Disable commands will show the driver this thing uses to protect the bogus bootsector, & stop it from loading IF it's still enabled, & you can take that rootkit's protective driver out as well this way, using those commands!
This is basically a "blended threat" type rootkit, using both driver based rootkit tech (runs Ring 0/RPL 0) AND bootsector originated rootkit tech!
* VERY Interesting, but those tools SHOULD 'make mincemeat outta it'...
APK
P.S.=> I don't believe you can do this from a Linux bootup with NTFS5 read/write, in disabling Windows drivers - that is, unless you guys know diff. that is - thanks for telling me IF there is a way in Linux to do that (would need Windows Registry read/write access & tools to write it properly too though)
... apk
Besides FIXMBR, it may need 1 more command from RC (recovery console in Windows install media) to "nuke it", check it:
http://tech.slashdot.org/comments.pl?sid=2275150&cid=36593272
Due to this thing protecting the MBR using drivers!
Yes, fixmbr will blow out the bootsector in Windows Recovery Console!
However: To be ABSOLUTELY sure it's 100% gone, the ListSvc & Disable commands will show the drivers loading & you can take them out as well this way, using those commands!
* This IS the first "blended-threat" type rootkit I've ever seen but...
(Still - This technique SHOULD do it, by blowing out the bogus mbr rootkit protective driver too, easily & pretty fairly quickly, though you MAY have to google for the driver name, I have not seen it YET in the articles & I'm beat, need to sleep here can't look...)
Listsvc will show all drivers loading/loaded, and you can use DISABLE on the "oddball" that this thing uses (probably won't have the descriptive field loaded, which SHOULD make it easier to spot too!)
APK
P.S.=> I don't believe you can do this from a Linux bootup with NTFS5 read/write, in disabling Windows drivers - that is, unless you guys know diff. that is - thanks for telling me IF there is a way in Linux to do that (would need Windows Registry read/write access & tools to write it properly too though)
... apk
Needs 2 more commands from RC (recovery console in Windows install media) to kill it, & any Windows (even older than 7, circa 2000-7, are NTFS5 ready), check it:
http://tech.slashdot.org/comments.pl?sid=2275150&cid=36593272
Due to this thing protecting the MBR using drivers, listsvc may be necessary with fixmbr!
Yes, fixmbr will blow out the bootsector in Windows Recovery Console, but to be ABSOLUTELY sure, the ListSvc & Disable commands will show the drivers loading & you can take them out as well this way, using those commands!
---
* This one's interesting, in that it's a "blended-threat" rootkit, one that uses BOTH driver-based rootkit tech AND bootsector originated rootkit-tech too...
APK
P.S.=> I don't believe you can do this from a Linux bootup with NTFS5 read/write, in disabling Windows drivers - that is, unless you guys know diff. that is - thanks for telling me IF there is a way in Linux to do that (would need Windows Registry read/write access & tools to write it properly too though)
... apk
I'll say it again.. good eff'n lord. Seriously. Wouldn't it be a great thing to put forth all the time, money, and energy wasted fixing these senseless problems into something more worthwhile? Those of us who know how to fix this without a complete OS reload is one thing, but the thought of all the time and productivity loss (globally) is simply disgusting. Not to mention all the grandparents or otherwise 'less-than-computer literate' out there who have to pay someone to come over and fix their box. This cat and mouse game with windows just rambles on.. feeding the lemmings who buy into this snakeoil... what people will put up with just so they don't have to learn something new. Sad. Windows just seems to lay down a welcome mat for these types of infections. Shame on you M$. What are people really paying for here? What is the net gain from using your operating system? Linux! Linux! Linux! is the medicine people! (okay, okay.. Macs can play too)
Needs 2 more commands from RC (recovery console in Windows install media) to kill it, & any Windows (even older than 7, circa 2000-7, are NTFS5 ready), check it:
http://tech.slashdot.org/comments.pl?sid=2275150&cid=36593272
Due to this thing protecting the MBR using drivers, listsvc may be necessary with fixmbr!
Yes, fixmbr will blow out the bootsector in Windows Recovery Console, but to be ABSOLUTELY sure, the ListSvc & Disable commands will show the drivers loading & you can take them out as well this way, using those commands!
---
* This one's interesting, in that it's a "blended-threat" rootkit, one that uses BOTH driver-based rootkit tech AND bootsector originated rootkit-tech too...
APK
P.S.=> I don't believe you can do this from a Linux bootup with NTFS5 read/write, in disabling Windows drivers - that is, unless you guys know diff. that is - thanks for telling me IF there is a way in Linux to do that (would need Windows Registry read/write access & tools to write it properly too though)
BY THE WAY? ROOTKITS ORIGINATED IN *NIX!
... apk
This is the Windows 7 System restore option, which is as follows according to MS:
see: System Restore
---
Restores your computer's system files to an earlier point in time without affecting your files, such as email, documents, or photos.
If you use System Restore from the System Recovery Options menu, you cannot undo the restore operation. However, you can run System Restore again and choose a different restore point, if one exists. For more information, see What is System Restore? and System Restore: frequently asked questions.
----
"You work for Symantec?"
It's been faster to download Ghost boot discs than install Ghost since the late 1990s.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
I've seen junk get onto a computer with all the latest windows updates where the infected user never intentionally ran a single program they downloaded from the web. However the infection happened, it happened without prompting the user to run any install program..
When I disinfected the computer, I could not for the life of me figure out how the infection was actually obtained... if the user had been an administrator, I suspect that the damage would have been more widespread than just that one account.
File under 'M' for 'Manic ranting'
They forgot to mention installing a new hard drive. From what I've read some of the latest trojans can even survive an OS re-install. I've got a Mac that dual boots and I had to abandon the Windows 7 part of the hard drive due to a nasty trojan that nothing was able to scrub out. Securty on Windows has become a joke. It's completely impossible to avoid all trojans and viruses. I got nailed with a redirect one that largely bricked my internet. Oddly enough the Mac partition is fine. I've never once had this problem with Mac. I had decided to go pure Mac until the latest Apple fuck up gave me second thoughts. They basically dropped Final Cut Pro and tried to replace it with an iMovie Pro. No one is buying it and most pro users are jumping ship. This screw up is forcing me to switch to Media Composer but then I have to deal with all the Windows BS. I can't win. Essentially everyone is turning their backs on the pro users. We used to be one of the strongest and most devoted areas of the market especially for the Mac but no one wants to waste time on the pro market. It's a perfect time for Linux to step up. With Mac and PC dropping the ball things are wide open to steal the pro market.
We all need a major re-think of how OS is installed on the computer, how it is architected, etc.
Seems to me that a low-level kernel in FLASH, which can only be upgraded with a hardware key inserted (e.g., the kernel FLASH blocks can only be written when there is a physical device plugged into the system), which then supports a number of different OS images using virtual machine concept, is the way to go. I the image of any VM gets rooted, you just toss it and revert to last backup. The flash is immune to tricks, because you must insert a hardware key to upgrade it, so trojans could not over-write the FLASH-based kernel, the worst that can happen is that one of the OS images get corrupted, then you just revert to saved.
Why not do this - in the flash, or the BIOS part of the system, have the micro-kernel, be it L4 or Minix, and in the hard drive, have the rest of the OS. Or better still, just as w/ RAM, you have L1 cache, L2 cache and L3 cache before having RAM, on the non-volatile side of things, have a NOR flash that contains the microkernel, have a NAND flash that contains the user level OS (like in Cisco's IOS routers) and above that, applications and everything go into an HDD or SSD. Oh, and both the NOR and NAND flashes will be non-writable, unless one flips a hardware switch on the system itself (like the wireless on/off switch on a laptop)
Of course, this would require re-engineering the system. Since Windows 7 is already both 32-bit and 64-bit, here is a suggestion - re-architect the 64-bit version of the OS to be a microkernal architecture that supports this model: have a common microkernel for Windows 8, Windows Phone, and any other Windows they may do. Then do the main OS, including the APIs, device drivers and all as user space that goes into the NAND. This portion can be varied depending on the platform.
As it is, Microsoft is now faced w/ having to develop for ARM, or remain locked w/ x86, where they have only Intel/AMD, while everyone else in the world is doing ARM. The microkernel approach would help here as well - that's all that would need to be ported, while the rest of the OS could get simply re-compiled to ride on the microkernel. Had Microsoft not dumped its MIPS and Alpha version of NT, they'd have had alternatives to the x86 today, since the 64-bit MIPS prodigy is architecturally capable of beating ARM on the latter's trump card - power consumption, while having top rate performance from the mid-90s.
Why do you keep re-posting the same information you've posted at least three times on this thread? And then have the poor taste to put a link to your previous posting of the same information?
What possible value could that add to this discussion?
No, no, you're not thinking; you're just being logical. --Niels Bohr
You don't keep the old system but put a new one on. Granted, it's not a bare install, but you wipe every bit of your drive and replace it with a known good config.
I was promised a flying car. Where is my flying car?
Ain't Linux only safe assuming that 'root' hasn't been compromised? Or else, it would be as vulnerable?
Speaking of which, in Windows 7 Pro, wouldn't such viruses only be allowed to penetrate if someone is working in Admin mode?
I don't remember the specifics, but a few years ago while following a tutorial on making a bootable thumb drive, I had been substituting the filesystem in the tutorial with my own.. Well along came the step which formatted the MBR and by accident I typed the wrong filesystem and whiped out my main drive's mbr (which held a windows partition, a linux partition and a data partition)..
Needless to say I went on a hunt for something to restore my MBR.. after a bit of playing around with some really crappy DOS based utilities I found a cross platform, and amazing tool called TestDisk: http://www.cgsecurity.org/wiki/TestDisk
In just a few minutes it had found my partitions and restored my MBR and my system was up and running as though nothing had ever happened..
Also it looks like a completely free/open source tool that supports most filesystems.. Really a life saver..
Anyways, I'd be this would be able to restore an MBR of an affected system.. If not you could always use a boot cd and install grub..
Which of those integrity checkers do you recommend for a shop that mostly uses the Windows OS? An extensive comparison says Samhain is the best.
The FAQsays Samhain works under Windows XP with Cygwin.
In Windows 7 there is a hidden, non-standard partition. I'm guessing that Samhain would not be able to check that partition. Does the design of Windows 7 prevent thorough integrity checking? Microsoft makes more money if Windows is vulnerable to malware. See the New York Times article Corrupted PC's Find New Home in the Dumpster.
I'm interested.
If it was Linux, at least you could automate such "reinstall", but with Windows, and I am saying this as a person who had to do this at least 10 times during the days I were using Windows, the software comes with their own binary installers, which are all dancing to their own tune and as a result nothing really can be automated, you have to babysit human-assisted installations. This is Photoshop, Creative Suite, most games - well, actually, pretty much EVERYTHING. Of course you can take snapshots and do change recordings and "replay" them, but the thing is that many applications break anyway when "reinstalled" that way - because more often than not, at least for the bigger vendors who can afford to spend time on such schemes, the installer generates keys for the registry which work one time only, bind to hardware configurations, time, phase of the moon and what not. In other words, replaying an installation later on results in dead software because even though it worked on your last Windows, it no longer does on your fresh setup. Most of these bummers have to do with flavors of DRM, of course.
Linux has a whole lot of its drawbacks too, but they did something right - distribution and installation of software is managed by a single known entity, that is also very automatable. In Windows, every installer is their own universe - a process that answers and bows to noone.
how about diffing the mbr with a known good copy, or checksumming on boot? is there any reason why this isnt done as standard for rootkit protection? (genuine question. inb4 "the virus could modify the copy/checksum")
I run as non admin. Overwriting the MBR requires a handle to "\\.\PhysicalDriveX". That requires Admin rights, so malware trying to do this would fail on my machine.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
Personally I have always believed in making sure a backup could be installed from bare metal upwards. An information backup doesn't take into account settings, serial numbers and the desire to hang on to a specific version of Microsoft Office because the next had a neutered UI called the ribbon..
When I felt I needed to rebuild the box I'd restore the first backup and let Windows patching do its evil thing for an hour - also saves having to play disk jockey for hours (pet hate: installers that don't ask all the questions at the beginning so you have to babysit the whole &%*$ process).
However, I must admit I'm not sure the tool I used (Acronis True Image) would also preserve the MBR.
Nowadays I use a Mac - there, a bare metal backup is even usable as system boot disk..
Insert
1. have OEMs sell PCs without windows disk (only a restore partition)
2.release infection and inform everyone disk needs wiped and reinstall to fix...
3.?????? (everyone that wiped their drives has to buy new install CD)
4. PROFIT!!!
Politics is Treachery, Religion is Brainwashing
1986: Brain is considered the first IBM PC compatible boot sector virus. ... and many more in between: http://en.wikipedia.org/wiki/Timeline_of_computer_viruses_and_worms
1987: Stoned, another boot sector virus had a one in eight probability that the screen would declare: Your PC is now Stoned!
1988: Ping-Pong virus, if a disk access is made exactly on the half hour and start to show a small "ball" bouncing around the screen.
And then download a few gigs of updates.... Or just switch to Mac or Linux.
"A recovery disc returns Windows to its factory settings."
This is wrong too. Mr. Feng in that blog is advocating using an offline boot disk of some sort to clean the machine, not flatten it, and reinstall:
"...we advise you to fix the MBR and then use a recovery CD to RESTORE YOUR SYSTEM TO A PRE-INFECTED STATE (as sometimes restoring a system may not restore the MBR). To fix the MBR, we advise that you use the System Recovery Console, which supports a command called "fixmbr".
So he advocating offline cleaning, and the fixmbr command. Frankly the fixboot command would be a good idea too, since updated versions may decide to also patch the Volume boot record, perhaps not being content with just the Master boot record.
I will take the time to clear out a nasty infection if it's my machine, but anyone else? I run a restore disk and am done with it.
I'm not taking 6 hours researching and scanning unless it's my computer, otherwise it doesn't make any sense.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
I managed to put the system disk of a linux machine that had been hacked to good use without reinstalling.
The drive platter makes an excellent coaster.
are you crazy?
Also... i assumed you asked her what happens to her stuff if the server is reset to factory settings?
HBGary has finally enacted their revenge with the most heinous rootkit ever conceived by man. BWAHAHAHAHAHAHAHAH!!!!!!!!
I ran into this rootkit before. It was a machine that wasn't heavily infected but NOD32 & MSE kept detecting this rootkit. Malwarebytes/combofix only detected the trojans the rootkit downloads, so it wasn't effective. After backing up the data I did a simply reinstall of the OS (where I did not do a low-level format) and shortly after installing the NIC drivers, a pop-up ad came up, so I reinstalled the AV software and it detected it again. I realized that this was low-level rootkit (MBR) and proceeded to re-do my reinstallation, but this time do a low-level format. I booted up KillDisk and ran it for a few minutes as it initially destroys the MBR. Then I reinstalled the OS and the PC was clean well into the future.
The clients I deal with, a simple format/reinstall is out of the question as these are business machines and although sometimes they get infected when they go 'surf' the internet, a lot of times it's through targeted attacks. I was the go-to guy when it came to infections as I was able to locate and delete a lot of these trojans/rootkits when AV software couldn't locate it. Fortunately, AV software has come a long way, especially free ones.
Previewing comments are for sissies!
Goddamn Ubuntu fanboys are even worse than Mac fanboys. Seriously, every post about an issue with Windows and "Here's your fix right here: www.ubuntu.com herp derp!"
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Why do users of a product (MSWindows) accept this?
"They have sold you a product that can be compromised, solution: return to previous compromisable product"!
It might not have failed you yet, but this isn't a tactic I would try on a machine that does anything important. The whole point of any rootkit is that it can modify any file, and thus unless you happen to have recent known-good md5sums for every single file on all drives attached to the system (and the time to check them all), you simply cannot trust the machine, and you cannot allow users to log on to it.
Your only option is to re-image or reinstall from scratch.
I just recently used Clonezilla to clone my work XP machine's drive and restored from the clone to verify that it worked. Awesome project if you ask me. That supports ext4 etc. It also makes it trivial to clone to a network share, something that seems to be absurdly difficult with Ghost.
...except that BIOS isn't much used for anything lately, except boot the OS.
When the OS starts it uses its own SATA/PATA/SAS/SCSI etc. drivers to access the discs.
So the BIOS lock won't help much.
Also, with modern OSes, the translation code in the infected MBR won't be enough. Later stages must be started in the OS too (like hacked drivers or something along these lines).
So back in old-school DOS world, the whole virus could reside in the MBR (or more likely : be loaded from the MBR as Grub does. There isn't much place in the MBR it self, but there are enough free sectors before the OS partition where to store the rest of Grub or Virus code).
Nowadays this MBR part is only good at making sure that later OS stages are still in place and are still going to be loaded early enough in the boot process, in order to be able to bury it-self and use further translation/obfuscation techniques to still go undetected while the rest of the OS is booting.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
On old system (and in the director's cut of Terminator 2 movie :-P ), the BIOS was only writeable if you set a hardware switch.
(If I remember correctly, the chip ran on 5v, but needed a 12v to be programmed. The physical jumper enabled this feed).
But it eventually got removed because people found too inconvenient to administer.
Nowadays not only you don't need anymore to open the PC case to upgrade the BIOS, one some machines you can even do it while still running Windows.
That mean that admin can remotely update the BIOS while the OS is still running (over VNC, for exemple).
But that mean that virus writter could do it to (welcome to the fantastic world of BIOS-based viruses)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
AV writers who ship bootable rescue disks that are pre-loaded with network device drivers can tell their customers "boot with the disk, do the rescue scan and have it check online for updates, and you'll be good to go."
For bonus PR points they can ship a "Popureb-fix.exe" program that you can put on your USB stick, CD (for 2-optical-disk-systems), or of Popureb won't interfere, on the infected hard disk then boot with a Windows recovery disk and fix it.
Those AV vendors not wedded to Windows for their boot media will have even more flexibility. I predict within a week we'll have a special-purpose Linux-based boot disk that does nothing but clean up this infection or at least disable it to the point that currently-available Windows-based AV programs can do the rest.
"Reinstall your system is the only way to fix the problem" should never be the solution.
"Reinstalling your system is the fastest, most sure-fire way to fix your system" is, unfortunately, frequently the case.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
It's worth noting that machines with bios infections can potentially be cleaned through a special disk designed to remove them (usually read only media like CD/DVD. What can be written, can be overwritten in most cases.
You are assuming that the sequence:
"Power on. Check for BIOS-recovery media. Recover BIOS."
never executes write-able BIOS.
If this is not the case then it can be intercepted and a BIOS-resident virus can potentially gain a permanent foothold, requiring hardware modification to bypass.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Rootkits are the WORST THREATS is why! Std. tools in AntiVirus &/or AntiSpyware like most folks use WON'T CUT IT usually vs. them, is why!
* That's all...
APK
P.S.=> This SHOULD work to "blow out" the bogus driver that protects & doubtless "rewrites" the bootsector with a bogus one again after FIXMBR tries to...
... apk
Rootkits are the WORST THREATS is why! Std. tools in AntiVirus &/or AntiSpyware like most folks use WON'T CUT IT usually vs. them, is why!
* That's all... to spread "the good word" here (hopefully).
APK
P.S.=> This SHOULD work to "blow out" the bogus driver that protects & doubtless "rewrites" the bootsector with a bogus one again after FIXMBR tries to...
... apk
See subject-line: My roots are in UNIX, VMS, & IBM stuff like OS/400... I actually like command lines (faster, less overheads, better for automation scripts etc./et al) - but, I still like my GUI as well once in Ring 3/RPL 3/UserMode operations!
* Commandlines have their place... network admins use them in say, logon scripts, yes - even in Windows, all the time!
(This is one of them, & it SHOULD work to eradicate the presence of this rootkit, completely)
APK
P.S.=> You may have a point on UNIX being the 1st one with rootkits & the reason why also...
... apk
The *nix security model allows a user to execute files that he owns, meaning he could compile malware (that he doesn't know is malware) from source and run it, and the malware would have full access to the user's account. Some larger businesses appear to have moved to the video game console security model, where nothing that isn't signed by a central authority is allowed to execute.
The only reason people's systems are getting infected by this is because they gave the software privileges even after being warned it was a security risk.
Which in turn is because the operating system has conditioned the user to think that nothing labeled a security risk is a true security risk. UAC (or counterparts on other operating systems) has cried "wolf" too many times.
It doesn't matter what you do, if you give them the option to bypass security then they voluntarily will.
But is this the case even if the maker of an appliance treats all homemade applications as security risks and sues those who sell the tools needed to bypass the security?
What does Krusty's Super Fun House have to do with anything?
See subject-line: Sorry - I omitted listing DOS as well by accident as to where I came from (commandline world of the 1980's during highschool to collegiate academia on my 1st degree, & even into the early 1990's for the most part, using DOS)!
APK
P.S.-=> Strictly speaking though, I shouldn't have put OS/400's "commandline" there (& I really started out on the IBM stuff using its predecessors/ancestors in System 34/36/38 actually)...
IBM "Big Iron" mainframe/midrange 'commandline' is NOT really like the others I noted in UNIX &/or VMS really (in fact, I think it's the BEST "CommandLine" there is, it has a series of fields you use & a built in help system etc. (quite different))
... apk
I still think that made sense, but obviously most mainboard vendors find even such simple measures too expensive.
There are lots of sharp pointy objects on a computer's motherboard. Requiring the end user to open the case to set a jumper would run into all sorts of product safety regulation.
See subject: So, you CAN "point" the registry editor to other machines via its File, Connect Network Registry system...
(HOWEVER - Like yourself? I am NOT 100% sure if that would work under an arrangement like WINE!)
* GOOD POINT on your part though, by all means...
APK
Mod themselves up again on pure b.s.: Here's how they downmod others (here is where countertrolling explains what he's doing while he trolls others to his fellow trolltalk.com friends):
http://slashdot.org/comments.pl?sid=2245866&cid=36491652
And, here's where his "troll mechanics" for downmodding others is explained in detail by someone that got sick of it happening:
http://slashdot.org/comments.pl?sid=2271908&cid=36579618
As far as bogus up moderations, the trolltalk.com bunch (tomhudson, countertrolling, & others) collectively "team up" to upmod one another, in teams, as favors to one another.
(Talk about low, and bogus!)
Can & will "blow this rootkit away" easily enough. Every Windows installation media in 2000/XP/Server 2003 have it & are NTFS5 version filesystem ready. Fixmbr command "rewrites the bootsector" but this rootkit has a protective driver that just overwrites it again (or blocks access to it). That's where listsvc comes in with disable.
listsvc - shows services AND DRIVERS load states @ bootup
disable - turns off services & drivers (after you find this rootkit's offending protective driver - it probably won't have a descriptive field filled in, so should be easier to spot as std. ones usually do (@ most/worst case, you google for the driver(s) in question to disable it)
See - IF you dig deep enough in the article's sources, you find this pertinent quote/excerpt that describes this rootkit's mechanics:
---
http://blogs.technet.com/b/mmpc/archive/2011/06/22/don-t-write-it-read-it-instead.aspx
PERTINENT QUOTE/EXCERPT:
"now it introduces a driver component to prevent the malicious MBR and other malicious data stored as disk sectors from being changed. The driver component protects the data in an unusual way Ã" by hooking the DriverStartIo routine in a hard disk port driver (for example, atapi.sys)"
---
So, that's WHY you need to use listsvc, & disable, alongside fixmbr to remove this thing...
(listsvc /? + disable /? show the help/man page for these commands so you can understand how to use them further in cases like this one... they're easy & simple to use!)
* This rootkits an "interesting case", because it's basically what's called a "blended threat" in the security world vs. malware-in-general, in that it uses BOTH bootsector originated rootkit tech, AND memory resident Ring 0/RPL 0 driver based protection...
APK
P.S.=> And, there you go: "Here endeth the lesson..."
... apk
Can & will "blow this rootkit away" easily enough. Every Windows installation media in 2000/XP/Server 2003 have it & are NTFS5 version filesystem ready. Fixmbr command "rewrites the bootsector" but this rootkit has a protective driver that just overwrites it again (or blocks access to it). That's where listsvc comes in with disable.
listsvc - shows services AND DRIVERS load states @ bootup
disable - turns off services & drivers (after you find this rootkit's offending protective driver - it probably won't have a descriptive field filled in, so should be easier to spot as std. ones usually do (@ most/worst case, you google for the driver(s) in question to disable it)
See - IF you dig deep enough in the article's sources, you find this pertinent quote/excerpt that describes this rootkit's mechanics:
---
http://blogs.technet.com/b/mmpc/archive/2011/06/22/don-t-write-it-read-it-instead.aspx
PERTINENT QUOTE/EXCERPT:
"now it introduces a driver component to prevent the malicious MBR and other malicious data stored as disk sectors from being changed. The driver component protects the data in an unusual way Ã" by hooking the DriverStartIo routine in a hard disk port driver (for example, atapi.sys)"
---
So, that's WHY you need to use listsvc, & disable, alongside fixmbr to remove this thing...
(listsvc /? + disable /? show the help/man page for these commands so you can understand how to use them further in cases like this one... they're easy & simple to use!)
* This rootkits an "interesting case", because it's basically what's called a "blended threat" in the security world vs. malware-in-general, in that it uses BOTH bootsector originated rootkit tech, AND memory resident Ring 0/RPL 0/kernel mode driver based protection...
APK
P.S.=> And, there you go: "Here endeth the lesson..."
... apk
Or you will not be able to access any DB with encryption or and ACL.
I guess I have a couple of comments here..
Any time I get the privilege of cleaning up an infected machine, the first thing I do is stick the drive in an external enclosure and scan it from a different machine. But that's only the first step..
I keep a BartPE boot CD handy - this lets me boot from the CD and inspect the infected disk. I can mount registry hives and clean them if needed.
In an ideal world, all binaries would be digitally signed - this would make it possible to identify all corrupted binaries, and identify all binaries in the windows folder that don't belong there.
But at the end of the day, a reformat/reinstall might end up being the easiest way to clean things up. The users of the machine might object, but if they hadn't gotten the thing infected in the first place they wouldn't have had to deal with the rest. The problem is that the users will want to restore all kinds of stuff from the infected machine, and in amongst this could be the initial attack vector.
Just another in a very long list of reasons to abandon Window (ME, 2000, NT, XP, Vista, 7) and move to MacOS or iOS.
I wonder why so few motherboards come with a TPM chip. With TPM you could set up a trusted boot sequence to immediately detect any tampering with the boot sector or the OS. I definitely intend to get a TPM-enabled board on my next upgrade. Unfortunately, now there's only Asus P7 series where you can buy the TPM module to plug in. Anybody know why it isn't available more widely?
As admin at my place of employment where I am dutifully engaged in running XP systems I figured I should be concerned with how this puppy proliferates. I'm starting to agree with the folks who think this is just a ruse to get people to reinstall, simply because there's no mention of transmission medium at all. Ooh, big scary virus out there! But where am I going to expect to find it? e-mails? PDFs? the web?
Usually companies like Symantec will have some documentation like this and so far I'm unable to find anything. Got linxx?
Once you have been infected with ANY malware capable of installing code, you're a fool to treat it any way other than requiring a nuke-and-pave. There is just no way of knowing what rootkits have been installed, what re-infection vectors have been put in place, or whether you've gotten everything. Sure, an antivirus product's cleaning function will probably get most of it. Maybe all of it. But there's no way to be sure, short of a full wipe.
So functionally, there really isn't any difference between an infection from this or any other download-capable malware. This one just requires what you really needed to do in the case of an infection anyway.
Everybody gets what the majority deserves.
Yeah I was speaking from experience.
I use Clonezilla for a lab I have that is dual boot Windows/Linux. On those machines, Ghost doesn't support ext4 (forces sector by sector copy, which takes FOREVER on a 150GB partition even if your zero the free space), nor does it copy GRUB properly.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
See, you wouldn't have these problems everyday if you used Unix/Linux!
".no yrraC ?os yas tsuj uoy t'ndid yhW . gabsag gnizidnargga-fles ,suoilicrepus yldevresednu na er'uoY .won ti teg I" - by NotSanguine - another done nothing with his life "ne'er-do-well" off-topic troll(1917456) on Tuesday June 28, @03:10PM (#36602330)
"???"
* Uhm, lol... Could we get a translation of that off-topic "troll-speak" of yours, please?
(LOL!)
APK
P.S.=> Yes, it must have just have been another off-topic done nothing of significance with his life troll blubbering his b.s. again & not contributing to the ongoing conversations. Oh well - No biggie!
... apk
If a rootkit was there once--how do you know that you have cleaned the fragments out of all of the persistent registers? Video cards, audio cards, hard drive, monitor, network cards, mobo BIOS?
the NPG electrode was replaced with carbon blac
I still don't see why we don't run as standard, VM's for internet access & for testing apps whose parentage we don't know about.
sandbox things before they get to the OS let alone the MBR
altho I thought I saw a VM escaped rootkit mentioned a few months back...
can't remember where tho
ON WINDOWS VISTA, WINDOWS 7, WINDOWS SERVER 2k8 - because the bootsector's structure's is NOT the same iirc as Windows 2000/XP/Server 2003!
For the 3 most modern Windows version in bold above, use their tools for writing the bootsector anew in lieu of the older Windows models' fixmbr program!
(HOWEVER - Theoretically, you COULD use Windows 2000/XP/Server 2003 listsvc & disable though on VISTA/7/Server 2008 though)
* Because all they do is query the registry in write it, respectively!
(The Registry's structure's been essentially the same since Win2k is why, & iirc, perhaps even before that (but, it's been ages since I ran Windows NT 3.51/4.0 here)).
APK
ON WINDOWS VISTA, WINDOWS 7, WINDOWS SERVER 2k8 - because the bootsector's structure's is NOT the same iirc as Windows 2000/XP/Server 2003!
For the 3 most modern Windows version in bold above, use their tools for writing the bootsector anew in lieu of the older Windows models' fixmbr program!
(HOWEVER - Theoretically, you COULD use Windows 2000/XP/Server 2003 listsvc & disable though on VISTA/7/Server 2008 though)
* Because all they do is query the registry in write it, respectively!
(The Registry's structure's been essentially the same since Win2k is why, & iirc, perhaps even before that (but, it's been ages since I ran Windows NT 3.51/4.0 here)).
APK
P.S.=> Just thought I'd note this, just in case others weren't aware of the diff.'s in bootsector structure...
... apk
ON WINDOWS VISTA, WINDOWS 7, WINDOWS SERVER 2k8 - that's because the bootsector's structure's is NOT the same iirc as Windows 2000/XP/Server 2003!
For the 3 most modern Windows version in bold above, use their tools for writing the bootsector anew in lieu of the older Windows models' fixmbr program!
(HOWEVER - Theoretically, you COULD use Windows 2000/XP/Server 2003 listsvc & disable though on VISTA/7/Server 2008 though)
* Because all they do is query the registry in write it, respectively!
(The Registry's structure's been essentially the same since Win2k is why, & iirc, perhaps even before that (but, it's been ages since I ran Windows NT 3.51/4.0 here)).
APK
P.S.=> Just thought I'd note this, just in case others weren't aware of the diff.'s in bootsector structure...
... apk
ON WINDOWS VISTA, WINDOWS 7, WINDOWS SERVER 2k8 - That is just because the bootsector's structure's is NOT the same iirc as Windows 2000/XP/Server 2003!
For the 3 most modern Windows version in bold above, use their tools for writing the bootsector anew in lieu of the older Windows models' fixmbr program!
(HOWEVER - Theoretically, you COULD use Windows 2000/XP/Server 2003 listsvc & disable though on VISTA/7/Server 2008 though)
* Because all they do is query the registry in write it, respectively!
(The Registry's structure's been essentially the same since Win2k is why, & iirc, perhaps even before that (but, it's been ages since I ran Windows NT 3.51/4.0 here)).
APK
P.S.=> Just thought I'd note this, just in case others weren't aware of the diff.'s in bootsector structure...
... apk
ON WINDOWS VISTA, WINDOWS 7, WINDOWS SERVER 2k8 - only because the bootsector's structure's is NOT the same iirc as Windows 2000/XP/Server 2003!
For the 3 most modern Windows version in bold above, use their tools for writing the bootsector anew in lieu of the older Windows models' fixmbr program!
(HOWEVER - Theoretically, you COULD use Windows 2000/XP/Server 2003 listsvc & disable though on VISTA/7/Server 2008 though)
* Because all they do is query the registry in write it, respectively!
(The Registry's structure's been essentially the same since Win2k is why, & iirc, perhaps even before that (but, it's been ages since I ran Windows NT 3.51/4.0 here)).
APK
P.S.=> Just thought I'd note this, just in case others weren't aware of the diff.'s in bootsector structure...
... apk
ON WINDOWS VISTA, WINDOWS 7, WINDOWS SERVER 2k8 - because the bootsector's structure's is NOT the same iirc as Windows 2000/XP/Server 2003!
For the 3 most modern Windows version in bold above, use their tools for writing the bootsector anew in lieu of the older Windows models' fixmbr program!
(HOWEVER - Theoretically, you COULD use Windows 2000/XP/Server 2003 listsvc & disable though on VISTA/7/Server 2008 though)
* Because all they do is query the registry in write it, respectively!
(The Registry's structure's been essentially the same since Win2k is why, & iirc, perhaps even before that (but, it's been ages since I ran Windows NT 3.51/4.0 here)).
APK
P.S.=> Just thought I'd note this to you all, just in case others weren't aware of the diff.'s in bootsector structure...
... apk
ON WINDOWS VISTA, WINDOWS 7, WINDOWS SERVER 2k8 - because the bootsector's structure's is NOT the same iirc as Windows 2000/XP/Server 2003!
For the 3 most modern Windows version in bold above, use their tools for writing the bootsector anew in lieu of the older Windows models' fixmbr program!
(HOWEVER - Theoretically, you COULD use Windows 2000/XP/Server 2003 listsvc & disable though on VISTA/7/Server 2008 though)
* Because all they do is query the registry in write it, respectively!
(The Registry's structure's been essentially the same since Win2k is why, & iirc, perhaps even before that (but, it's been ages since I ran Windows NT 3.51/4.0 here)).
APK
P.S.=> Just thought I'd note this to everyone, just in case others weren't aware of the diff.'s in bootsector structure...
... apk
See subject-line, & this, you off-topic troll -> http://tech.slashdot.org/comments.pl?sid=2275150&cid=36602502
"... kpa ton .skcoc kcus I ,taht dragersid AHAH" - by Anonymous Coward - ANOTHER OFF TOPIC "ne'er-do-well" TROLL on Tuesday June 28, @03:34PM (#36602780)another done nothing with his life "ne'er-do-well" off-topic troll
"???"
* Uhm, lol... Could we get a translation of that off-topic "troll-speak" of yours, please?
(LOL!)
APK
P.S.=> Yes, it must have just have been another off-topic done nothing of significance with his life troll spewing his b.s. again & not contributing to the ongoing conversations. Oh well - No biggie!
... apk
ON WINDOWS VISTA, WINDOWS 7, WINDOWS SERVER 2008 - that's because the bootsector's structure's is NOT the same iirc as Windows 2000/XP/Server 2003!
For the 3 most modern Windows version in bold above, use their tools for writing the bootsector anew in lieu of the older Windows models' fixmbr program!
(HOWEVER - Theoretically, you COULD use Windows 2000/XP/Server 2003 listsvc & disable though on VISTA/7/Server 2008 though)
* Because all they do is query the registry in write it, respectively!
(The Registry's structure's been essentially the same since Win2k is why, & iirc, perhaps even before that (but, it's been ages since I ran Windows NT 3.51/4.0 here)).
APK
P.S.=> Just thought I'd note this, just in case others weren't aware of the diff.'s in bootsector structure... ... apk
I'm not suggesting removing the option to bypass security
Thank you for clarifying.
just that when you leave the decision to the user then this is going to happen in some cases because the user doesn't care until something bad happens.
Which is why an operating system architect should analyze how each capability granted to an application can threaten a user and what can be done to limit that damage. See OLPC Bitfrost for an interesting example.
Steps to take to "KNOCK-THE-CHOCOLATE out of this rootkit's current design:
---
1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)
---
* This absolutely WILL work!
(That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the registry drivers initialization area: They do THAT? "HOUSTON WE HAVE A PROBLEM!" )
APK
P.S.=> Then, it WILL be "reinstall time" if they protect that area of the registry from the DISABLE RC COMMAND above (because that only takes on reboot)
... apk
Steps to take to "KNOCK-THE-CHOCOLATE out of this rootkit's current design:
---
1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)
---
* This absolutely WILL work!
(That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area, in the registry (which disable can stop): They do THAT? "HOUSTON WE HAVE A PROBLEM!" )
APK
P.S.=> Then, it WILL be "reinstall time" if they protect that area of the registry from the DISABLE RC COMMAND above (because that only takes on reboot)
... apk
Steps to take to "KNOCK-THE-CHOCOLATE out of this rootkit's current design:
---
1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)
---
* This absolutely WILL work!
(That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area, in the registry (which RC's disable can stop): They do THAT? "HOUSTON WE HAVE A PROBLEM!" )
APK
P.S.=> Then, it WILL be "reinstall time" if they protect that area of the registry from the DISABLE RC COMMAND above (because that only takes on reboot)
... apk
Steps to take to "KNOCK-THE-CHOCOLATE" out of this rootkit's current design:
---
1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)
---
* This absolutely WILL work!
(That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area, in the registry (which disable can stop): They do THAT? "HOUSTON WE HAVE A PROBLEM!" )
APK
P.S.=> Then, it WILL be "reinstall time" if they protect that area of the registry from the DISABLE RC COMMAND above (because that only takes on reboot)
... apk
Steps to take to "KNOCK-THE-CHOCOLATE" out of this rootkit's current design:
---
1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)
---
* This absolutely WILL work!
(That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area, in the registry (which disable can stop): They do THAT? "HOUSTON WE HAVE A PROBLEM!" )
APK
P.S.=> Then, it WILL be "reinstall time", if they protect that area of the registry from the DISABLE RC COMMAND above (because that only takes on reboot)
... apk
Steps to take to "KNOCK-THE-CHOCOLATE" out of this rootkit's current design:
---
1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)
---
* This absolutely WILL work!
(That is, until the rootkit makers CHANGE the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area, in the registry (which disable can stop): They do THAT? "HOUSTON WE HAVE A PROBLEM!" )
APK
P.S.=> Then, it WILL be "reinstall time" if they protect that area of the registry from the DISABLE RC COMMAND above (because that only takes on reboot)
... apk
Steps to take to "KNOCK-THE-CHOCOLATE" out of this rootkit's current design:
---
1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)
---
* This absolutely WILL work!
(That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area, in the registry (which disable, can stop): They do THAT? "HOUSTON WE HAVE A PROBLEM!" )
APK
P.S.=> Then, it WILL be "reinstall time" if they protect that area of the registry from the DISABLE RC COMMAND above (because that only takes on reboot)
... apk
Steps to take 2 "KNOCK-THE-CHOCOLATE" out of this rootkit's current design:
---
1.) Recovery Console bootup
2.) listsvc command to spot offending bogus MBR protecting driver
3.) disable command to stop it from loading
4.) Reboot to RC again
5.) Fixmbr command to clear bootsector (no longer protected by said driver since it was disabled from load)
6.) REBOOT NORMALLY (it WILL be gone, guaranteed)
---
* This absolutely WILL work!
(That is, until the rootkit makers change the rootkit's bogus MBR protecting driver to not only protect the fake MBR, but also the rootkit's driver initialization area, in the registry (which disable can stop): They do THAT? "HOUSTON WE HAVE A PROBLEM!" )
APK
P.S.=> Then, it WILL be "reinstall time" if they protect that area of the registry from the DISABLE RC COMMAND above (because that only takes on reboot)
... apk
The hello_tt.sys UNSIGNED driver from installing (as this rootkit does): easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:
---
Configure Driver Signing Through Group Policy Editor:
http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/
You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!
(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))
---
AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!
---
AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!
I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs
http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960
PERTINENT QUOTE/EXCERPT:
---
"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?
Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):
ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:
---
bcdedit /deletevalue loadoptions
bcdedit -set TESTSIGNING OFF
---
* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)
---
Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)
---
(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)
---
However - The nicest part is here?
Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!
(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)
* Once more/Again? "Here endeth the lesson..."
APK
P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):
---
"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:
http://www.youtube.com/watch?v=SP74aJBbIoY
---
Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"
(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" was "so bad" & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)
... apk
like hello_tt.sys, the one this rootkit installs, easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:
---
Configure Driver Signing Through Group Policy Editor:
http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/
You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!
(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))
---
AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!
---
AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!
I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs
http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960
PERTINENT QUOTE/EXCERPT:
---
"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?
Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):
ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:
---
bcdedit /deletevalue loadoptions
bcdedit -set TESTSIGNING OFF
---
* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)
---
Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)
---
(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)
---
However - The nicest part is here?
Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!
(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)
* Once more/Again? "Here endeth the lesson..."
APK
P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):
---
"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:
http://www.youtube.com/watch?v=SP74aJBbIoY
---
Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"
(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" was "so bad" & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)
... apk
Unsigned device driver installs like hello_tty.sys (one this rootkit uses to protect the bogus bootsector) easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:
---
Configure Driver Signing Through Group Policy Editor:
http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/
You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!
(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))
---
AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!
---
AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!
I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs
http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960
PERTINENT QUOTE/EXCERPT:
---
"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?
Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):
ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:
---
bcdedit /deletevalue loadoptions
bcdedit -set TESTSIGNING OFF
---
* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)
---
Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)
---
(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)
---
However - The nicest part is here?
Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!
(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)
* Once more/Again? "Here endeth the lesson..."
APK
P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):
---
"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:
http://www.youtube.com/watch?v=SP74aJBbIoY
---
Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"
(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" there was "so bad", & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)
... apk
Unsigned device driver installs like hello_tt.sys (one this rootkit installs) easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:
---
Configure Driver Signing Through Group Policy Editor:
http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/
You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!
(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))
---
AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!
---
AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!
I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs
http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960
PERTINENT QUOTE/EXCERPT:
---
"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?
Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):
ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:
---
bcdedit /deletevalue loadoptions
bcdedit -set TESTSIGNING OFF
---
* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)
---
Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)
---
(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)
---
However - The nicest part is here?
Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!
(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)
* Once more/Again? "Here endeth the lesson..."
APK
P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):
---
"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:
http://www.youtube.com/watch?v=SP74aJBbIoY
---
Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"
(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" was "so bad" & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)
... apk
Unsigned device driver installs (like hello_tt.sys the one this rootkit installs) easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:
---
Configure Driver Signing Through Group Policy Editor:
http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/
You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!
(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))
---
AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!
---
AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlinesas well!
I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs
http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960
PERTINENT QUOTE/EXCERPT:
---
"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?
Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):
ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:
---
bcdedit /deletevalue loadoptions
bcdedit -set TESTSIGNING OFF
---
* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)
---
Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)
---
(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)
---
However - The nicest part is here?
Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!
(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)
* Once more/Again? "Here endeth the lesson..."
APK
P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):
---
"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:
http://www.youtube.com/watch?v=SP74aJBbIoY
---
Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"
(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" was "so bad" there in that film, & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)
... apk
Unsigned device driver installs (like hello_tt.sys the one this rootkit installs) easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:
---
Configure Driver Signing Through Group Policy Editor:
http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/
You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!
(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))
---
AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!
---
I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs
http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960
PERTINENT QUOTE/EXCERPT:
---
"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?
Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):
ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:
---
bcdedit /deletevalue loadoptions
bcdedit -set TESTSIGNING OFF
---
* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)
---
Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)
---
(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)
---
However - The nicest part is here?
Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!
(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)
* Once more/Again? "Here endeth the lesson..."
APK
P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):
---
"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:
http://www.youtube.com/watch?v=SP74aJBbIoY
---
Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"
(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" was "so bad" there in that CLASSIC film, & allegedly "indestructable/unbeatable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)
... apk
Unsigned device driver installs (like hello_tt.sys the one this rootkit installs) easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:
---
Configure Driver Signing Through Group Policy Editor:
http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/
You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!
(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))
---
AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!
---
I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs
http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960
PERTINENT QUOTE/EXCERPT:
---
"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?
Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):
ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:
---
bcdedit /deletevalue loadoptions
bcdedit -set TESTSIGNING OFF
---
* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)
---
Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)
---
(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)
---
However - The nicest part is here?
Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!
(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)
* Once more/Again? "Here endeth the lesson..."
APK
P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):
---
"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:
http://www.youtube.com/watch?v=SP74aJBbIoY
---
Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"
(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" was "so bad" & "indestructable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)
... apk
Unsigned device driver installs (like hello_tt.sys the one this rootkit installs) easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:
---
Configure Driver Signing Through Group Policy Editor:
http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/
You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!
(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))
---
AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!
---
I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs
http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960
PERTINENT QUOTE/EXCERPT:
---
"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?
Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):
ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:
---
bcdedit /deletevalue loadoptions
bcdedit -set TESTSIGNING OFF
---
* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)
---
Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)
---
(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)
---
However - The nicest part is here?
Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!
(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)
* Once more/Again? "Here endeth the lesson..."
APK
P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):
---
"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:
http://www.youtube.com/watch?v=SP74aJBbIoY
---
Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"
(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" was "so bad" + allegedly "indestructable & unbeatable" like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)
... apk
Unsigned device driver installs (like hello_tt.sys the one this rootkit installs) easily & Windows WARNS YOU of "test mode" when one's installed to bypass signed drivers checks - I know this from building & testing filtering drivers in fact:
---
Configure Driver Signing Through Group Policy Editor:
http://www.lockergnome.com/nexus/windows/2006/03/27/configure-driver-signing-through-group-policy-editor-xp-2/
You can BLOCK it even happening vs. rootkits like this one OR others like it that try to install bogus drivers as this one did in hello_tt.sys!
(In fact... Using GPEDIT.MSC &/or SECPOL.MSC this way is in my "layered-security guide" for Windows -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE & has been for YEARS now (since 2007))
---
AND, Again - This can also as a "layered security defense" here too vs. unsigned drivers installations along with the bcdedit commandlines I showed in my post I replied to here as well!
---
I also already posted this DAYS ago here on /., regarding this rootkit, & on the subject of bypassing unsigned driver installs
http://it.slashdot.org/comments.pl?sid=2306598&cid=36694960
PERTINENT QUOTE/EXCERPT:
---
"Should the rootkit/botnet maker alter His rootkit/botnet's design to protect the registry area driver init. section for hello_tt.sys as well as the bootsector as he currently does for this "blended threat tech" rootkit/botnet?
Well - You can stop unsigned driver loads & installs, this way, via a .bat batchfile, or .cmd command script (or even a logon script for those amongst you that are networkers):
ADD THESE 2 LINES TO LOGON SCRIPTS or .bat/.cmd scripts to run @ machine startup:
---
bcdedit /deletevalue loadoptions
bcdedit -set TESTSIGNING OFF
---
* That will stop ANY unsigned driver installation bypass used by malware/botnet/rootkit makers attempting to use drivers in their malwares!" - by APK on Friday July 08, @11:11AM (#36694960)
---
Yes - There's also other ways to implement it as well, such as a scheduled task if one wishes, or a network machine level or domain level admin wishes... and in older Windows models prior to Windows 7/VISTA/Server 2008, this can be handled in boot.ini (see a reference to options there)
---
(Once more - Group Policy can too, LAN/WAN wide if needed & iirc, it's ON BY DEFAULT too - but it would adversely affect those who develop device drivers - you might be 'forced into' making another usergroup is all, for devicedriverdevs is all... @ most!)
---
However - The nicest part is here?
Well once more - Windows "warns you" when you enter this mode using UNSIGNED DRIVERS!
(I know this, because when I've built filtering drivers, it says in the lower right-hand corner of your screen, above the clock TEST MODE when unsigned drivers are allowed during testing of device drivers!)
* Once more/Again? "Here endeth the lesson..."
APK
P.S.=> Quoting my fav. hero as a boy here, from classical Greek Mythos, in AKhilleus (Greek spelling of Achilles), son of Peleus (when middle names are usually those of the father or grandfather = APK, lol!):
---
"Is there no one else? IS THERE NO ONE ELSE??" - Achilles, son of Peleus, portrayed by Brad Pitt in the classic 2004 film, TROY here:
http://www.youtube.com/watch?v=SP74aJBbIoY
---
Play it from 2:50 onwards, for the "FULL EFFECT" (lol) & "Absolutely LIVE!"
(For what I feel I've done to this rootkit, & others like it via my techniques, lol, since "Boagrius" was "so bad" & also allegedly "indestructable + unbeatable", just like this rootkit/botnet was alleged to be, and to my naysayers here also, easily!)
... apk