Shining a spotlight on rootkits

A rootkit, like a cloak of invisibility, is a program that conceals the presence of an application on a computer. Installing itself silently, it stays concealed by hiding processes, files, network traffic and other

    Requires Free Membership to View

    Login

observable information about itself from the computer user. Rootkits typically hide utilities that make it easy for attackers to return to a compromised system. Rootkits aren't easily detected and since no single vendor reliably detects all rootkits, it can be beneficial to work with more than one free rootkit tool.

Sophos Anti-Rootkit is a sophisticated rootkit detector and remover for Windows NT, 2000, XP and 2003. Before scanning, it's strongly recommended to close down all non-essential applications. A rootkit scan can take several minutes on a desktop computer or significantly longer on a server. The scan searches for hidden files, processes, registry keys and values. When the scan finishes, a pop-up screen appears, confirming the status and results of the scan. Click on the suspicious file to display more information about it. The information displayed includes whether the item is recommended for removal. If a suspicious file is recognized it can be safely removed, and if the scanner isn't sure what it is, but considers it suspicious, it can still be removed.

For more information:
In this SearchSecurity.com Q&A, information security threats expert Ed Skoudis discusses four ways to prevent rootkit installation.

Learn how to prevent an FU rootkit from spreading throughout your network. 

In this Q&A, security expert Michael Cobb explains how rootkit hypervisors can affect operating system security.
Panda AntiRootkit, like Sophos, has a GUI and allows for command-line options. Also like Sophos, it identifies known rootkits and suspicious rootkit behaviors indicative of unknown rootkits and provides the option of removing them along with their associated registry entries, processes and files. Panda AntiRootkit looks for hidden files, registry entries, drivers, processes, execution hooks and does an excellent job of ferreting out possible rootkits. Panda AntiRootkit runs on Windows 2000, XP and 2003. It does a thorough job of removing dangerous rootkits even when it can't fully identify them.

If one of the rootkit scanners mentioned above doesn't do it for you, you can also run additional rootkit detection and removal tools such as:

McAfee Rootkit Detective is a program designed to detect and clean rootkits and works on XP, 2000 and 2003. However, McAfee strongly recommends its software only be used by knowledgeable individuals at the direction of, and with the support of a representative from McAfee Avert Labs or McAfee Technical. AVG Anti-Rootkit Free provides for rootkit detection and removal and works on Windows 2000 and XP.

Rootkit detection and removal is showing up as part of more anti-virus packages, but these scanners can help provide an additional line of defense against the dark arts.

About the author:
Scott Sidel is an ISSO with Lockheed Martin.

This was first published in August 2007

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.

    Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.

    Back to top