Full Disclosure: Re: Full-Disclosure Digest, Vol 89, Issue 15 suspicion of rootkit (Alexandru Balan)

["Mikhail A. Utin" <mutin () commonwealthcare org>]

-----Original Message-----
From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of 
full-disclosure-request () lists grok org uk
Sent: Thursday, July 12, 2012 4:40 AM
To: full-disclosure () lists grok org uk
Subject: Full-Disclosure Digest, Vol 89, Issue 15

Send Full-Disclosure mailing list submissions to
        full-disclosure () lists grok org uk



I've had very similar case of downloading software and getting a malware. I wanted just to get it fixed, so wheither a 
virus, or worm, or rootkit I do not know.
Symptoms were disabled Windows update and Windows networking. TCP in general worked.
I found malicious files (just a few) using one of security tools running under Linux CD-bootable to check consistency 
of Windows files. First I tried three AV systems (F-Secure, Kaspersky and Symantec), but they were useless. Finally, 
from Linux I was able to find files having inconsistent attributes, as far as I remember - the size and modification 
date.

Nothing of particular, but: AV systems identify less than 90% of malware (both forward and backward tests), when 
downloading freeware  stuff a virtual machine is the best option, and if after just installing of freeware Windows 
screw up, it is obvious what is the reason for.

Mikhail

----------------------------------------------------------------------

Message: 1
Date: Thu, 12 Jul 2012 00:46:33 +0300
From: Alexandru Balan <jaymzu () gmail com>
Subject: Re: [Full-disclosure] suspicion of rootkit
To: phocean <0x90 () phocean net>
Cc: full-disclosure () lists grok org uk, Valdis.Kletnieks () vt edu
Message-ID: <C0574EE4-8509-4FF4-AB60-565D0A256E11 () gmail com>
Content-Type: text/plain; charset="iso-8859-1"

Tried checking it with an AV ? 
http://quickscan.bitdefender.com 

On Jul 12, 2012, at 12:06 AM, phocean wrote:

> The machine is Windows XP SP3 quite up-to-date, but not fully. Except that Windows Update is not working anymore.
> One of the symptoms. 
>
> I described the issues there:
> http://www.phocean.net/2012/06/30/rootkit-in-my-lab.html
> http://www.phocean.net/2012/07/11/rootkit-in-my-lab-part-ii.html
>
> You will see why some symptoms make me think about a rootkit.
>
> You are right, it could be some Windows being messed up.
> But it actually happened on a pretty fresh install: I finished setting XP and tens of analysis tools (I aimed this 
> box to be my fresh reversing system).
> So even if possible, it sounds strange that a machine gets corrupted so quickly. And of course, I suspect some of 
> these tools, got from multiple downloads.
> At last, I could analyse them one by one of course, but there are many so it would be painful (and I am not sure that 
> I kept all setups).
>
> --- phocean
CONFIDENTIALITY NOTICE: This email communication and any attachments may contain confidential 
and privileged information for the use of the designated recipients named above. If you are 
not the intended recipient, you are hereby notified that you have received this communication 
in error and that any review, disclosure, dissemination, distribution or copying of it or its 
contents is prohibited. If you have received this communication in error, please reply to the 
sender immediately or by telephone at (617) 426-0600 and destroy all copies of this communication 
and any attachments. For further information regarding Commonwealth Care Alliance's privacy policy, 
please visit our Internet web site at http://www.commonwealthcare.org.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/