SEC309

AdvancedMalwareCleaningMarkRussinovichTechnicalFellow,PlatformandServicesDivisionMicrosoftCorporationmark.russinovich@AboutMeTechnicalFellow,MicrosoftCo-founderandchiefsoftwarearchitect

ofWinternalsSoftwareCo-authorofWindowsInternals,4theditionandInsideWindows2000,3rdEditionwithDavidSolomonAuthoroftoolson

HomeofblogandforumsSeniorContributingEditor,WindowsITProMagazinePh.D.inComputerEngineeringWhyIsManualCleaningNecessary?Howdousersgetmalware?Theydownloadappsthatincludeadwareandspyware

TheyclickonmisleadingpopupsorbannersTheyvisitsitesthatuseexploitstoinjectmalwareManyusersstilldon’tpatchordon’tuseantivirusorantispywareWhydoesn’tantivirusandantispywarestopmalware?TheyaredependentonsignaturesMalwaredirectlyattacksitAlwaysperformmanualcleaningafteryou’verunavailableantivirusandantispywareMalwareCleaningStepsDisconnectfromthenetworkIdentifymaliciousprocessesanddriversTerminateidentifiedprocessesIdentifyanddeletemalware

autostartsDeletemalwarefilesRebootandrepeatIdentifyingMalwareProcessesWhatAreYouLookingFor?Processesthat……h(huán)avenoicon…h(huán)avenodescriptionorcompanyname…unsignedMicrosoftimages…liveinWindowsdirectory…arepacked…includestrangeURLsintheirstrings…h(huán)aveopenTCP/IPendpoints…h(huán)ostsuspiciousDLLsorservicesWhatAboutTaskManager?TaskManagerprovideslittleinformationaboutimagesthatarerunningProcessExplorerProcessExploreris“SuperTaskManager”RunsonWindows95,98,Me,NT,2000,XP,Server2003Alsosupports64-bit(x64)andVistaHaslotsofgeneraltroubleshootingcapabilities:DLLversioningproblemsHandleleaksandlockedfilesPerformancetroubleshootingHungprocessesWe’regoingtofocusonitsmalwarecleaningcapabilitiesTheProcessViewTheprocesstreesortshowsparent-childrelationshipsIcon,description,andcompanynamearepulledfromimageversioninformationMostmalwaredoesn’thaveversioninformationWhataboutmalwarepretendingtobefromMicrosoft?We’lldealwiththatshortly…UsetheWindowFinder(inthetoolbar)toassociateawindowwithitsowningprocessUsetheGooglemenuentrytolookupunknownprocessesButmalwareoftenusestotallyrandomorpseudo-randomnamesRefreshHighlightingRefreshhighlightinghighlightschangesRed:processexitedGreen:newprocessChangeduration(default1second)inOptionsPressspacebartopauseandF5torefreshCausedisplaytoscrolltomakenewprocessesvisiblewithShowNewProcessesoptionProcess-typeHighlightsBlueprocessesarerunninginthesamesecuritycontextasProcessExplorerPinkprocesseshostWindowsservices(we’lllookatservicesshortly)Purplehighlightingindicatesanimageis“packed”PackedcanmeancompressedorencryptedMalwarecommonlyusespacking(e.g.UPX)tomakeantivirussignaturematchingmoredifficultPackingandencryptionalsohidesstringsfromviewThereareafewothercolors,butthey’renotimportantformalwarehuntingTooltipsProcesstooltipsshowthefullpathtotheprocessimageMalwaremoreoftenhidesbehindSvchostandRundll32TooltipforRundll32processesshowshostedDLLTooltipforserviceprocessesshowshostedservicesServicescoveredindetailshortly…DetailedProcessInformationDouble-clickonaprocesstoseedetailedinformationImage

tab:Description,companyname,version(from.EXE)FullimagepathCommandlineusedtostartprocessCurrentdirectoryParentprocessUsernameStarttimeImageVerificationAll(well,most)MicrosoftcodeisdigitallysignedHashoffileissignedwithMicrosoft’sprivatekeySignatureischeckedbydecryptingsignedhashwiththepublickeyYoucanselectivelycheckforsignatureswiththeVerifybuttonontheprocessimagetabSelecttheVerifyImageSignaturesoptiontocheckallAddtheVerifiedSignercolumntoseeallNotethatverificationwillconnecttotheInternettocheckCertificateRevocationList(CRL)serversWindowsServicesServicescanstartwhenthesystembootsandrunindependentlyofthelogged-onuserExamplesincludeIIS,Themes,Server,Workstation,…CanrunastheirownprocessorasaserviceDLLinsideaSvchost.exeTheservicestabshowsdetailedserviceinformation:Registryname(HKLM\System\CurrentControlSet\Services\...)DisplaynameDescription(optional)DLLpath(forSvchostDLLs)StringsOn-diskandin-memoryprocessstringsarevisibleontheStringstabThere’sonlyadifferenceiftheimageiscompressedorencryptedStringscanhelpprovidecluesaboutunknownprocessesLookforURLs,namesanddebugstringsYoucanalsodumpstringswiththecommand-lineStringsutilityfromSysinternalsTheDLLViewMalwarecanhideasaDLLinsidealegitimateprocessWe’vealreadyseenthiswithRundll32andSvchostTypicallyloadsviaanautostartCanloadthrough“dllinjection”PackinghighlightshowsinDLLviewaswellOpentheDLLviewbyclickingontheDLLiconinthetoolbarShowsmorethanjustloadedDLLsIncludes.EXEandany“memorymappedfiles”CansearchforaDLLwiththeFinddialogDLLstringsarealsoviewablefromtheDLLmenu`LoadedDriversThereareseveraltoolsforviewingconfigureddrivers:Start->Run->Msinfo32BuiltinSCcommand:scquerytype=driverDeviceManagerwithView->ShowHiddenDevicesProcessExplorerDLLviewfortheSystemprocessshowsloadeddriversEvendriversthatdeletetheirimagefilesSamepathandversioninfoasstandardDLLviewSimplyidentifythemnowUsuallythey’renotstoppableDeletetheirfilesandautostartsettingslaterTCPViewLookforsuspiciousnetworkendpointswithTCPViewYoucandothisbylookingattheTCP/IPtabofeachprocess,butthat’sslowTCPViewalsousesrefreshhighlightingTCPViewincludesa“closeconnection”capability…butyoushouldbedisconnectedfromthenetworkTerminatingMaliciousProcessesDon’tkilltheprocessesMalwareprocessesareoftenrestartedbywatchdogsInstead,suspendthemNotethatthismightcauseasystemhangforSvchostprocessesRecordthefullpathtoeachmaliciousEXEandDLLAftertheyareallasleepthenkillthemWatchforrestartswithnewnames…CleaningAutostartsInvestigatingAutostartsWindowsXPMsconfig(Start->Run->Msconfig)fallsshortwhenitcomestoidentifyingautostartingapplicationsItknowsaboutfewlocationsItprovideslittleinformationAutorunsShowseveryplaceinthesystemthatcanbeconfiguredtorunsomethingatboot&logonStandardRunkeysandStartupfoldersShell,userinitServicesanddriversTasksWinlogonnotificationsExplorerandIEaddins(toolbars,BrowserHelperObjects,…)Moreandevergrowing…EachstartupcategoryhasitsowntabandallitemsdisplayontheEverythingtabStartupname,imagedescription,companyandpathIdentifyingMalware

AutostartsZoom-inonadd-ons(includingmalware)byselectingtheseoptions:VerifyCodeSignaturesHideMicrosoftEntriesSelectanitemtoseemoreinthelowerwindowGoogleunknownimagesDouble-clickonanitemtolookatwhereitsconfiguredintheRegistryorfilesystemHasotherfeatures:CandisplayotherprofilesCanalsoshowemptylocations(informationalonly)IncludescomparefunctionalityIncludesequivalentcommand-lineversion,Autorunsc.exeDeletingAutostartsDeletesuspiciousautostartsYoucandisablethemifyou’renotsureAfteryou’redonedoafullrefreshIftheycomeback,runProcessMonitor(orFilemonandRegmon)toseewho’sputtingthembackYoumighthavemisidentifiedamalwareprocessItmightbeahidden,system,orlegitimateprocessRootkitsWhat’saRootkit,Anyway?HoglundandButlerwritein“Rootkits:SubvertingtheWindowsKernel”: Arootkitisasetofprogramsandcodethatallowsapermanentorconsistent,undetectablepresenceonacomputer.

Mydefinition: Softwarethathidesitselforotherobjects,suchasfiles,processes,andRegistrykeys,fromviewofstandarddiagnostic,administrative,andsecuritysoftware.Hoglund’sreviseddefinitionfromRonFebruary4: Arootkitisatoolthatisdesignedtohideitselfandotherprocesses,data,and/oractivityonasystem.TheEvolutionofMalwareMalware,includingspyware,adwareandviruseswanttobehardtodetectand/orhardtoremoveRootkitsareafastevolvingtechnologytoachievethesegoalsCloakingtechnologyappliedtomalwareNotmalwarebyitselfExamplerootkit-basedviruses:W32.Maslan.A@mm,W32.Opasa@mmRootkithistoryAppearedasstealthvirusesOneofthefirstknownPCviruses,Brain,wasstealthFirst“rootkit”appearedonSunOSin1994Replacementofcoresystemutilities(ls,ps,etc.)tohidemalwareprocessesModernRootkitsRootkitscanhidevirtuallyanything:ProcessesFiles,directories,RegistrykeysServices,driversTCP/IPportsThereareseveraltypesofrootkittechnology:User-modehookingKernel-modehookingCodepatchingHidinginotherprocessesistheprimaryrootkitforumExampleRootkitCloakingAttackuser-modesystemqueryAPIsExamples:HackerDefender,AfxTaskmgr.exeNtdll.dllRootkitExplorer.exe,

Winlogon.exeusermodekernelmodeExplorer.exe,Malware.exe,Winlogon.exeRootkitDetectionAllcloakshaveholesLeavesomeAPIsunfilteredHavedetectablesideeffectsCan’tcloakwhenOSisofflineRootkitdetectionattacksholesCat-and-mousegameRootkitDetectionTypesThreeclassesofrootkitdetection:SignaturebasedMicrosoftMaliciousSoftwareRemovalToolAnomalydetectionSystemVirginityVerifier:http:///tools.htmlGMER:http:///index.phpIceSword:/tools/200509/IceSword_en1.12.rarCross-viewcomparisonF-SecureBlacklight:

/blacklight/Sysinternals

RootkitRevealerUsemorethanonetool!RootkitRevealerRootkitRevealer(RKR)runsonlineRKRtriestobypassrootkittouncovercloakedobjectsAllcross-viewdetectorslisteddothesameRKRscansHKLM\Software,HKLM\SystemandthefilesystemPerformsWindowsAPIscanandcompareswithrawdatastructurescanRootkitRevealerRootkitWindowsAPIRawfilesystem,

RawRegistryhiveFilteredWindowsAPIomitsmalwarefilesandkeysMalwarefilesandkeys

arevisibleinrawscanRootkitRevealerLimitationsRootkitshavealreadyattackedRKRdirectlybynotcloakingwhenscannedRKRisgiventruesystemviewWindowsAPIscanlookslikerawscanWe’vemodifiedRKRtobeahardertodetectbyrootkitsRKRisadoptingrootkittechniquesitselfRootkitauthorswillcontinuetofindwaysaroundRKR’scloakIt’sagamenobodycanwinAllrootkitdetectorssufferthesamevulnerabilityLocalKernelDebuggingWindbgsupports“l(fā)ocalkerneldebugging”(LKD)WorkslikestandardkerneldebuggingwhichrequirestwocomputersRequiresMicrosoftDebuggingToolsForWindows(freedownloadfromMicrosoft)CanexaminekernelstructuresofalivesystemSupportedonXPandhigherincluding64-bitForNT4andWindows2000useSysinternals’Livekd

BothrequirematchingkernelsymbolsUseMicrosoft’ssymbolserver(documentedinhelpfile)LKDRootkitHuntingListrunningprocessesandcomparewithProcessExplorer:!process00ListloadeddriversandcomparewithProcessExplorer:.reloadlmkvLookforkernelhot-patches:!chkimg-dntDumpthesystemservicetableandinterruptdispatchtable(IDT):dd

kiservicetable!idt-aFindingandDeletingMalwareFilesSigcheckScanthesystemforsuspiciousexecutableimagesLookforsamecharacteristicsassuspiciousprocessesBeespeciallywaryofitemsinthe\WindowsdirectoryInvestigateallunsignedimagessigcheck-e-u-sc:\DeletingHard-to-DeleteFilesFilesthatareopenormappedcan’tbedeletedFindowningprocesswithProcessExplorersearchTerminatetheprocessanddeletethefileIfyoustillcan’tdeleteit(itmightbeprotectedbyadriverorsystemprocess):TryrenamingitIfthatfails,scheduleitfordeletionatthenextrebootwithSysinternals’Movefile:Ifitstillwon’tgoaway,deleteitfromanoff-lineOSmovefile

malware.exe“”DeletingHard-to-DeleteRegistryKeysWatchforkeysecuritySomeantispywaretoolsdon’treportaccess-deniederrorsUseRegmontocheckforerrorsUseRegedittochangesecuritypermissionsSomekeyshave