NWA-PCUG Newsletter Article, September 2007
Malware Rootkit Detection and Removal
By Ira Wilsker, APCUG Director;
Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host

(click to email author)

http://vil.nai.com/vil/stinger/rkstinger.aspx (McAfee)

According to the online encyclopedia Wikipedia, a rootkit is, “…a set of software tools intended to conceal running processes, files or system data from the operating system. Rootkits have their origin in benign applications, but in recent years have been used increasingly by malware to help intruders maintain access to systems while avoiding detection. Rootkits exist for a variety of operating systems, such as Microsoft Windows, Mac OS X, Linux and Solaris. Rootkits often modify parts of the operating system or install themselves as drivers or kernel modules.” In simpler terms, the contemporary rootkits are a type of malware that can install a virus or spyware in a way that is designed to avoid detection by traditional antivirus and anti-spyware software. Rootkits sometimes are buried deep inside the operating system or registry in such a way as to avoid detection by traditional means while they carry out their nefarious purposes.

Most of the popular security software installed on our computers offer little or no protection from rootkits, and may be incapable of stopping the malware from engaging in its dangerous behaviors. In recent months some of the major and lesser security software publishers have released a variety of utilities to detect and remove rootkits. Some of these publishers, including some of the best known commercial software publishers, have generously released their anti-rootkit products as free software, sometimes with an indication that the anti-rootkit product will be included in the next major release of their integrated security suites. One of the first rootkit detection utilities released was F-Secure Blacklight (http://www.f-secure.com/blacklight), which will be free at least until October 1, 2007. Blacklight can detect and remove rootkits that are undetectable by antivirus software, and is already integrated in its F-Secure Internet Security 2007. Blacklight has been proven to be a reliable rootkit detector, and has earned a faithful following, as well as kudos from the technical press. Blacklight would be a worthwhile “first choice” for those who want to detect and remove rootkits.

Popular security software publisher McAfee has released its Rootkit Detective, available for free download at vil.nai.com/vil/stinger/rkstinger.aspx. Rootkit Detective is a powerful and full featured rootkit remover, so powerful and thorough that McAfee actually issues a warning about using it on its website, “McAfee Rootkit Detective should only be used by knowledgeable individuals at the direction of, and with the support of, a representative from McAfee Avert Labs or McAfee Technical Support. Improper usage of this tool could result in damage to your applications or operating system.” Rootkit Detective is so powerful that it also detects legitimate files that may be hidden in the operating system, such as legitimate security software. Users of McAfee Rootkit Detective should completely read and understand the provisos on the web page before using it.

Trend Micro has released its RootkitBuster for free download at http://www.trendmicro.com/download/rbuster.asp. According to Trend Micro, “Trend Micro RootkitBuster is a rootkit scanner that offers ability to scan for hidden files, registry entries, processes, drivers and hooked system service. It also includes the cleaning capability for hidden files and registry entries. I have personally used RootkitBuster and found it very easy to use.

Microsoft, always trying to be a one-stop resource for all software needs, recently released an updated and free version of its RootkitRevealer. This product was originally released as freeware by its creator, SysInternals, which was subsequently bought out by Microsoft. RootkitRevealer is easy to use, and can detect all known rootkits listed at http://www.rootkit.com.

Now being a Microsoft product, RootkitRevealer is sure to earn a large following. Another very popular anti-rootkit product is available for free from Grisoft, known as AVG Anti Rootkit Free. It is available for download at http://www.grisoft.com/doc/download-free-anti-rootkit. According to Grisoft, “Rootkits are used to hide the presence of a malicious object like trojans or keyloggers on your computer. If a threat uses rootkit technology to hide itself it is very hard to find the malware on your PC.” I also have personally used AVG Anti Rootkit Free and found it very easy to use with an intuitive interface. I also found, in my limited experience, one of the fastest rootkit scanners that I tried. It would be a very good choice for anyone who wants to detect and remove rootkits from his system.

Rootkits have lately become a method of choice for miscreants and other criminals to take control of your computer without your knowledge. Since rootkits are almost undetectable using conventional security software they pose a substantial threat to our computing safety. Rootkits have recently been cited as a common tool used by identity thieves to hide keyloggers on our computers that can evade detection. Keyloggers are an especially dangerous type of spyware that can capture usernames, passwords, credit card numbers, and other sensitive personal information, and send that information to criminal elements. While most keyloggers can be detected and cleaned by anti-spyware software, keyloggers that are also rootkits may be undetectable unless explicitly detected by anti-rootkit software such as the titles listed above.

While not as well known as its better known cousins, viruses, trojans, and spyware, rootkits are becoming a more common threat that may slip through our defenses. I strongly recommend that everyone downloads and installs one or two of the free products above and periodically scans his computer for rootkit threats.

Click here to return to top