A Personal First: A Rootkitted 64 Bit Operating System And A Nice Boot Disc From Microsoft To Clean It

This week I encountered a 64 bit Windows machine infected with a rootkit.

It’s a Vista Home Premium SP2 system and it was doing some strange things.  The fake hard drive is failing warnings were the first I’ve seen of that variation but very much in the school of fake anti-virus pop-up windows.  Internet Explorer kept popping open unbidden and crashing, with mystery audio playing out of apparently nowhere (Vista’s Volume Mixer didn’t identify it as being from any particular application).  The audio included voices in conversation saying strange and partly intelligible things followed by strange laughter.  It also included something that sounded like what you’d find from Flash video from any number of major websites.

The usual anti-malware tools, Malwarebytes Anti-Malware and installed anti-virus (in this case Microsoft Security Essentials), cleaned up the fake warnings after I disabled them in Safe Mode and could actually run the tools.

The Internet Explorer issue and the strange audio didn’t resolve, and when I let Windows Update install some drivers that included an Intel Storage ICH9M-E/M SATA AHCI controller Vista had a complete BSOD freak out upon rebooting.  The blue screen was OxED Unmountable Boot Volume, not really something you want to see, and only booting from the Vista setup disc and letting it System Restore got me back into Windows.

(The Startup Repair from the hard drive would only give me a welcome screen with "Other User" as the login account. At the bottom left corner was an "Ease of Access" blue button.  I had no password for Other User and when I clicked on it I had the option to enter a user name and password but none of the existing accounts would work.)

My suspicions were severely raised at this point so I thought I’d try out Microsoft’s Standalone System Sweeper Beta.  I downloaded the 64 bit version of the installer and chose to let it create an ISO image that I burned to one of my handy DVD+RW discs.  (They are great for exactly this sort of thing.  If I need the Sweeper with newer definitions I just create a new ISO and burn it to the same disc.)  The web site says the Sweeper needs to be the same architecture as the target machine.  I don’t think you can run the 64 bit version on a machine with a CPU that only is 32 bit compatible and in any case the Sweeper will not let you scan an operating system that is a different architecture than the one you are booting.   If you boot the 32 bit Sweeper you can’t scan a 64 bit operating system and vice versa.  You can make either the 32 or 64 bit Sweeper boot disc regardless of which operating system is installed on the computer on which you are creating the disc.

Anyway, the Sweeper found the Alureon\TDSS\TDL3 rootkit (info here, here and here) and removed it.  When I got back into Windows I used Kaspersky’s TDSSKiller to remove leftover bits.  It’s possible that TDSSKiller alone would have done the job but I like the idea that I scanned Windows from outside the operating system and any rootkit would be inactive.

The system seemed snappier and considerably less strange afterwards.  Internet Explorer stopped opening spontaneously and stopped crashing and there wasn’t the odd 50% CPU action I had seen from some Dell applications threads before the cleaning.

I was quite pleased to have the Microsoft Sweeper since I can’t run GMER in a 64 bit operating system.  The very measures (mandatory signed drivers, etc.) that make it hard to rootkit a 64 bit system also make it harder to build anti-rootkit software, and the reduced vulnerability makes going to that effort significantly less worthwhile.  The fact that 64 bit operating systems are harder to infect made the dearth of cleaner tools not matter for a time, but now that this 64 bit capable rootkit is in the wild the story has changed.

The Sweeper installer can burn a disc directly for you and it can also build or update a bootable USB flash drive.  You will need an Internet connection to download the latest files and you’ll need 250 MB of space on a CD, DVD or flash drive.  The first time it creates the flash drive it formats it, but you can still use the balance of its capacity for storage after that.  When the installer updates the flash drive it doesn’t format it again or mess with any other content.  It just updates the virus definition file (about 60 MB).  This is very, very handy.

If you have a live connection to the Internet on the target machine the Sweeper can update its virus definitions when it is booted.  You can also download the definitions manually on another computer and put them on removable media to import from when the Sweeper is run.  Browse to http://go.microsoft.com/fwlink/?LinkID=96776 and download either the 32 bit or 64 bit definitions for Microsoft Security Essentials.  The Sweeper seems to be a standalone version of Microsoft Security Essentials so they use the same definitions.

A note on system requirements:

Microsoft gives a single list of requirements for both the installer computer and the target computer.  To work, they suggest the Sweeper needs the system to be Windows XP Service Pack 3 or newer with at least a 500 MHz or 1 GHz processor and 768 MB of RAM or 1 GB of RAM respectively depending on whether the operating system is XP or Vista/Windows 7.  This is awfully fuzzy “information”.

I tested the 64 bit Sweeper in VirtualBox on a target Windows 7 64 bit operating system and set it to use varying amounts of RAM.  At 752 MB or less the Sweeper will boot but can’t load its virus definitions so it won’t let you scan.  That’s great if you want to show somebody a Windows 7 looking startup screen (the Sweeper boots what looks like a Windows 7 Preinstallation Environment) but for cleaning a system it is useless.  At 753 MB it will boot and load the definitions and scan but it can’t update its definitions.  Still, that’s usable and the scan will be as current as your boot disc’s virus definitions.  At 843 MB it will successfully download updates to its virus definitions.

Using Windows Virtual PC and the 32 bit version of Sweeper, I found at up to 633 MB it couldn’t load its definitions and therefore wouldn’t scan.  Starting at 634 it could load its definitions but not update.  Starting at 714 MB it could could boot, scan and update its virus definitions properly.

To summarize, the 64 bit Sweeper is functional at 753 MB or higher and fully functional starting at 843 MB of RAM while the 32 bit version is functional at 634 MB and fully functional at 714 MB.

I also found that with sufficient RAM the Sweeper will boot and scan a Windows 2000 machine (although it failed to update with code 0x0072ee7 “server could not be resolved”, but a manual update from media worked) so it looks like the operating system requirement is more for the installer than the target computer.  That makes sense.

Windows 7 Forums has a nice tutorial on creating and using the Sweeper.

There are a couple more tutorials from Ask Leo! and Security Garden.  The latter also has a useful article called Solve Microsoft Standalone System Sweeper Errors.

Making OS X Play Nicely (Read/Write) With The NTFS File System

There is supposed to be native support for Read/Write access to NTFS formatted drives from Max OS X 10.6 Snow Leopard.  Word on the street is that this turned out to be unreliable and unstable so it is disabled by default (but it can be enabled from the command line).  OS X still has stable native Read Only access to NTFS but you can’t write to it.

At least you can’t without paying something for Paragon NTFS or paying nothing for the open source Catacombae NTFS-3G for Mac OS X and FUSE for OS X (OSXFUSE).  NTFS-3G is the NTFS Read/Write driver and FUSE is… well let’s just quote the relevant Wikipedia article:

Filesystem in Userspace (FUSE) is a loadable kernel module for Unix-like computer operating systems that lets non-privileged users create their own file systems without editing kernel code. This is achieved by running file system code in user space while the FUSE module provides only a "bridge" to the actual kernel interfaces.

There was an older FUSE that I had originally found called MacFUSE which is the project from which OSXFUSE is derived but I had trouble finding 64 bit support.  A lead from a blog called offTheHill brought me to OSXFUSE where I found 32 and 64 bit support ready to go in an easy to install DMG file.

I downloaded and installed the DMG files for NTFS-3G and OSXFUSE and unmounted and remounted the NTFS external drive and voila…. there was Read/Write access to the NTFS drive.

Obligatory warning: NTFS-3G is sometimes described as “experimental” given that there is no public specifications for the NTFS file system.  However, this project is mature enough that I would trust it with my data.

An Amusing Hack To Fix A Broken AVG Free Updater

I was helping someone with their computer when I noticed that their AVG Free hadn’t updated since October 5th.  When I clicked Update Now it would hang when it got to the point where it was “Analyzing new updates”

Apparently this is now a known issue for AVG on XP 64 bit systems.

After a little browsing online I found that a workaround was available for users of the paid AVG version.  It involved changing the Advanced Settings so that AVG first looked to the secondary update server rather than the primary update server.

The catch for users of AVG Free is that there is no option to change the update servers or their priority.

It occurred to me that while I couldn’t change the name of the primary update server I could certainly change the IP number that Windows used to go find that server.  I added this entry to the C:\WINDOWS\system32\Drivers\etc\hosts file:

212.96.161.241    guru.avg.com

The IP number is actually the address of the secondary update server bguru.avg.cz, so when AVG does its normal update it thinks it is checking the primary server but is actually checking the secondary server.

But there’s a rub….  AVG protects the Hosts file in order to prevent exactly this sort of chicanery which can be used for very nefarious purposes.  It will block this change or perpetually alert about the change even if it has been ignored.

Fortunately I was able to add the Hosts file to AVG’s Resident Shield’s Exceptions list.  I couldn’t enter the file by choosing it from the Add File button but I could add the path to the Drivers folder and then use the Edit List button to change it to point specifically to the Hosts file within the etc folder.

AVG update works perfectly with this arrangement.  However, now the Resident Shield is not protecting against any other changes to the hosts file.  That should be fine if the machine is clean, since having updated definitions should block incoming infections.  If the machine gets infected and starts messing with the Hosts file then it could be a big problem, for example preventing the anti-virus program from updating or sending seemingly innocuous web links to very bad places.

I estimated that the benefits exceeded the risks in this case especially since it is for a limited time until I revert the changes when AVG issues their final fix.