Rootkit for Dummies, Wiley

E-books Shop
Rootkit for Dummies

by Larry Stevenson and Nancy Altholz


About the Authors
Nancy Altholz (MSCS, MVP): Nancy is a Microsoft Most Valuable Professional
in Windows Security. She holds a master’s degree in Computer Science
and an undergraduate degree in Biology and Medical Technology. She is a
Security Expert, Rootkit Expert and Forum Lead, and Wiki Malware Removal
Sysop at the CastleCops Security Forum. She has also volunteered at other
online security forums. As Wiki Malware Removal Sysop, she oversees and
authors many of the procedures that assist site visitors and staff in system
disinfection and malware prevention. As a Security Expert and Rootkit
Expert, she helps computer users with a variety of Windows computer security
issues, including malware removal. Nancy coauthored the Winternals
Defragmentation, Recovery, and Administration Field Guide for Syngress
Publishing which was released in June 2006. She has recently been asked to
write the foreword for a book authored by Mingyan Sun and Jianlei Shao,
(developers of the DarkSpy Anti-rootkit program), on advanced rootkit detection
techniques. She was formerly employed by Medelec: Vickers’ Medical
and Scientific Division, as a Software Engineer in New Product Development.
Nancy’s interest in malware and rootkits evolved as a natural extension of
her interest in medicine and computers, due to the many parallels between
computer infection and human infection. Besides the obvious similarities in
naming conventions, both require a lot of detective work to arrive at the
correct diagnosis and enact a cure. Nancy enjoys investigating the malware
life cycle, and all the factors and techniques that contribute to it – in short,
she likes solving the puzzle, and of course, helping people, along the way.
Nancy lives with her family in Briarcliff Manor, NY.

Larry Stevenson: Larry has worked as a security consultant for over fifteen
years. His education is abundant, including continuing studies in computer
security, history, and fine arts. Larry works as an expert, volunteer moderator,
and writer on staff at CastleCops, providing assistance and written
articles to all users. In 2005, he wrote weekly articles on computer security
topics for the Windows Security Checklist series. He helped develop, and
co-wrote the CastleCops Malware Removal and Prevention procedure. For these
published efforts he was given the MVP Award: Microsoft Most Valuable
Professional in Windows Security, 2006. Currently a co-founder with Nancy
Altholz of the CastleCops Rootkit Revelations forums, he continues to develop
ways for users to obtain assistance and information from rootkit experts.
A Canadian citizen, he is currently employed at a multi-function, governmentowned
facility which includes private residences for people with special
needs, a senior citizens care home, daycare center, offices, a cafeteria and a
public access theater. For over seven years he has served as the Chief Steward
in the union local, negotiating contracts and solving workplace issues.

Publishing and Editorial for Technology Dummies
Richard Swadley, Vice President and Executive Group Publisher
Andy Cummings, Vice President and Publisher
Mary Bednarek, Executive Acquisitions Director
Mary C. Corder, Editorial Director
Publishing for Consumer Dummies
Diane Graves Steele, Vice President and Publisher
Joyce Pepple, Acquisitions Director
Composition Services
Gerry Fahey, Vice President of Production Services
Debbie Stailey, Director of Composition Services


Contents at Glace
Introduction .........1
Part I: Getting to the Root of Rootkits .....7
Chapter 1: Much Ado about Malware .............9
Chapter 2: The Three Rs of Survivable Systems .......25
Part II: Resistance Is NOT Futile....35
Chapter 3: Practicing Good Computer Hygiene ......37
Chapter 4: Staying Secure Online .......61
Chapter 5: Patching and Updating Your System and Software........101
Chapter 6: Blurring the Lines of Network Security .......117
Part III: Giving Rootkits the Recognition They Deserve......149
Chapter 7: Getting Windows to Lie to You: Discovering How Rootkits Hide..151
Chapter 8: Sniffing Out Rootkits ...............179
Chapter 9: Dealing with a Lying, Cheating Operating System ..........231
Part IV: Readying for Recovery......301
Chapter 10: Infected! Coping with Collateral Damage ....303
Chapter 11: Preparing for the Worst: Erasing the Hard Drive ....323
Part V: The Part of Tens .....336
Chapter 12: Ten (Plus One) Rootkits and Their Behaviors......337
Chapter 13: Ten (Plus Two) Security Sites That Can Help You .......347
Appendix: About the CD ........355
Index ......367

Table Of Contents
Introduction............1
About This Book................1
Things You Should Know ........2
What You’re Not to Read..........3
Foolish Assumptions ..................3
How This Book Is Organized.......3
Part I: Getting to the Root of Rootkits ......4
Part II: Resistance Is NOT Futile ........4
Part III: Giving Rootkits the Recognition They Deserve ....4
Part IV: Readying for Recovery.............5
Part V: The Part of Tens.............5
Icons Used in This Book...............5
Where to Go from Here..........6
Part I: Getting to the Root of Rootkits
Chapter 1: Much Ado about Malware
Some Common Questions (and Answers) about Malware ....9
Knowing the Types of Malware ..........10
Viruses ............11
Worms.......................11
Trojans......................11
Dialers .......................12
Backdoors .................12
Spyware (and malicious adware) .............13
The Many Aims of Malware.......................16
Rootkits: Understanding the Enemy.....................19
A Bit of Rootkit Lore.................................19
New Technologies, New Dangers ..............21
Why do rootkits exist? ....................22
Chapter 2: The Three Rs of Survivable Systems
Formulating Resistance..................26
Hackers may not be smarter than you .......26
Steps to a Better Security Posture .......27
Practicing Recognition ....................30
Spotting signs of malware ...........31
Recognizing when the problem isn’t malware...........33
Suspecting that you’ve been compromised..........33
Planning for Recovery ......................33
Part II: Resistance Is NOT Futile
Chapter 3: Practicing Good Computer Hygiene
Before Doing Anything. . .............37
Using System Restore .............38
Backing up your Registry ............42
Backing up your stuff with Windows Backup ....44
Cleaning Your Windows to Improve Security ......46
Everything and the kitchen sink: Loading
only what you need at startup ........47
Removing unused programs ..............50
Using the Windows Disk Cleanup Utility ........51
Defragmenting your hard drive ...........53
Using Registry cleaners ...............57
Controlling Removable Devices .........58
Disabling AutoRun..................58
Turning off AutoPlay on all external drives and devices ...59
Scanning boot sectors before using external media...........60
Chapter 4: Staying Secure Online
Choosing your contacts carefully .....62
Surfing safely..................63
Developing strong passwords.............69
Establishing limited-access user accounts ......70
Using a HOSTS file ....................72
Bashing Your Browser into Submission .........73
Saying no to Java, JavaScript, and ActiveX........74
Adding sites to your Trusted zone......76
Disable AutoComplete in Internet Explorer.......77
Using the New Internet Explorer 7 ...........77
Surfing with Firefox instead ..............80
Staying ahead of the game with SiteAdvisor.....81
Must-Have Protections Online...................82
Firewall first .....................83
Scanners Next .................95
Chapter 5: Patching and Updating Your System and Software
Preventing Rootkits by Patching Your Clothes .....102
Updating Your Operating System........103
Patching, updating, and Service Packing .........103
Looking at why you need updates ..........104
Knowing where you can get them ..........105
Taking advantage of Automatic Updates.....105
Guide to Windows Update and Microsoft Update.......106
Patching and Updating Your Software........113
Ways to patch or update your applications......113
Watching Internet sources for known
problems with your applications.............114
Patching and updating shared computers in heavy use ...114
Knowing When You Need a New Computer.......115
Chapter 6: Blurring the Lines of Network Security
A Checklist for Improving Security .....118
Learning to Love Auditing............119
Enabling security auditing ...........120
Using Windows Access Control...........126
Editing policies and configuring security.........126
Making your own security-analysis utility ......127
Testing your system against a security template......127
Customizing a security template for a network ....135
Preventing Attacks by Limiting Access .........139
Limiting and controlling physical access........140
Using limited-access user accounts........140
Limiting access on networks ........141
Making a business security plan ......143
Fooling Rootkits with Virtual Operating Systems.......144
Planning Your Defense Against Rootkits ......145
Establishing a baseline ..........146
Preparing Recovery Discs .........147
Part III: Giving Rootkits the Recognition They Deserve
Chapter 7: Getting Windows to Lie to You:
Discovering How Rootkits Hide
Discovering How Rootkits Hide and Survive...151
Keys to the Kingdom: Privileges ...........153
Knowing the Types of Rootkits ........154
User-mode versus kernel-mode rootkits .......155
Persistent versus non-persistent rootkits.....157
Hooking to Hide.............157
How hooking works..............158
Knowing the types of hooks........159
DLLs and the rootkits that love them .......160
Privileged hooks ............166
Using Even More Insidious Techniques to Hide Rootkits ....171
Direct kernel-object manipulation ......171
Trojanized utilities .........174
Looking into the Shady Future of Rootkits .......175
Hiding processes by doctoring the PspCidTable ........175
Hooking the virtual memory manager.....176
Virtual-machine-based rootkits ...........177
Chapter 8: Sniffing Out Rootkits
Watching Your Network for Signs of Rootkits .....179
Watching logs for clues.......180
Defending your ports .....183
Catching rootkits phoning home.......192
Examining the firewall............193
Trusting Sniffers and Firewalls to See What Windows Can’t .....199
How hackers use sniffers..........200
Using sniffers to catch hackers at their own game.......200
Testing to see whether your NIC is in promiscuous mode ....201
Sniffers you can use ............202
Investigating Lockups and Other Odd Behavior......206
Accessing Event Viewer...........206
Making some necessary tweaks to streamline logging.......207
Inspecting event logs with Windows Event Viewer ...........210
Upgrading to Event Log Explorer .............217
Trying MonitorWare..............219
Checking Your System Resources.............222
Matching activity and bandwidth ............223
Examining active processes...........224
Monitoring CPU cycles .............228
Chapter 9: Dealing with a Lying, Cheating Operating System
Rooting Out Rootkits ..............232
Cleaning a network................233
Before doing anything . ........234
The best overall strategy ...........234
Scanning Your OS from an External Medium.........234
Microsoft WinPE ...................235
Non-Microsoft bootable CDs............236
File-System Comparison from Full Boot to Safe Mode .......238
Checkpointing Utilities with Offline Hash Databases.........240
Verifying files with FileAlyzer.......240
Verifying file integrity with other utilities ..........243
Rootkit-Detection Tools.............244
Autoruns: Aiding and abetting rootkit detection .........246
Rootkit Revealer .................247
F-Secure BlackLight Beta ..........251
IceSword .................253
UnHackMe .......................260
Malicious Software Removal Tool ........261
AntiHookExec.........262
VICE.......................269
System Virginity Verifier (SVV)..........270
Strider GhostBuster ...........273
Rootkitty ...............274
RAIDE .............275
DarkSpy...................276
GMER................283
Detecting Keyloggers..........289
Types of keyloggers .............289
Detecting keyloggers with IceSword.........290
Detecting keyloggers with Process Explorer ..........291
Tracking a RAT: Using Port Explorer to trace Netbus 1.60 ....293
Part IV: Readying for Recovery
Chapter 10: Infected! Coping with Collateral Damage
Deciding What to Do if You’re Infected ......303
Knowing when to give up and start from scratch......305
What happens when the patient can’t be saved .......307
Do you want to track down the rootkit-er, or just recover?....307
Taking measured action............308
“My Computer Did What?!”.............310
Saving evidence to reduce your liability ...310
Preparing for Recovery ................318
Cutting off network connection before cleaning out the rootkit......319
Planning your first reboot after compromise ......320
Chapter 11: Preparing for the Worst: Erasing the Hard Drive
Don’t Trust System Restore After Rootkit Compromise ...323
When a Simple Format and Reinstall Won’t Work ........325
Erasing Your Hard Drive and Installing the Operating System ......327
What you need before you begin this procedure .....328
Erasing, partitioning, and formatting .......329
Installing Windows XP ................331
After you install . . . ........333
. . . And beyond .........333
Part V: The Part of Tens
Chapter 12: Ten (Plus One) Rootkits and Their Behaviors
HackerDefender..........338
NTFShider ...............339
Elite Toolbar ............339
Apropos Rootkit ...............340
FU — the Malware That’s Also an Insult .......341
FUTo................342
MyFip ...................342
eEye BootRoot...........343
FanBot...............343
pe386................344
Shadow Walker ............345
Chapter 13: Ten (Plus Two) Security Sites That Can Help You
Aumha...........348
Bleeping Computer ............348
CastleCops Security Professionals.........349
Geeks to Go ........350
Gladiator Security Forum..............351
Malware Removal...........351
Microsoft Newsgroups............352
Sysinternals Forum (Sponsor of Rootkit Revealer Forum)........352
SpywareInfo ........352
SpywareWarrior.............353
Tech Support Guy Forum..............353
Tom Coyote Security Forum .........354
Appendix: About the CD........355
System Requirements...............355
Using the CD with Microsoft Windows.........356
Installing the DART CD applications.........356
How to burn an ISO image to CD .........357
What You’ll Find on the DART CD ......357
Bonus Chapters ........358
Anti-malware utilities and scanners .........358
Backup and imaging applications ........359
System-analysis programs...........360
Rootkit-detection-and-removal applications ...........361
Password protectors and generators ........362
Downloading tools for compromised hard drives .....362
Troubleshooting..............363
Index...........367

Introduction
Welcome to Rootkits For Dummies, a book written for regular folks who
need a better understanding of what rootkits are, what we can do to
protect our computers and networks against them, and how to detect and
remove them. Like Sergeant Schultz on Hogan’s Heroes, you may be among
those who know “nothing, nothing” at all about them. Even the name rootkit
may be unfamiliar to you — but soon everyone with a computer and Internet
access will know how dangerous these malware programs can be.

First, a bit of myth-busting: Rootkits have a scary reputation — just because
they’re designed to escape detection by ordinary methods, supposedly they
can’t be seen or extracted. For most of them, that’s balderdash. Rootkits are
an extraordinary bit of deviance, to be sure, but they can be detected — and
removed — using tools developed specifically for those tasks. You may still
need the help of an expert, but cleaning out those nasty beasties is possible.

Rootkits For Dummies can help you gain insight into the realm of malware,
giving you the knowledge and abilities to assess and develop your own plan
to prevent this scourge from ruining your day (or week, or year). Whether
you have a standalone computer or have a business network to run as an
administrator, this book will show you what you can do about rootkits — and
help you secure your system against cyber-criminals and all malware, online and off.

You are about to begin a journey from the basics of malware in general to the
complex processes of rootkits. We are your guides, with you every step of the
way, as you move toward greater computer security competency. We have
done our best to provide the most effective tools available, and we’ve left
markers along the path so you won’t get lost. In short, this book is both your
passport and roadmap to a new beginning in the never-ending saga of Internet security.

 Screenshot 
E-books Shop

Purchase Now !
Just with Paypal



Product details
 Price
 File Size
 7,080 KB
 Pages
 425 p
 File Type
 PDF format
 ISBN
 978-0-471-91710-6
 Copyright
 2007 by Wiley Publishing, Inc  
●▬▬▬▬▬❂❂❂▬▬▬▬▬●
●▬▬❂❂▬▬●
●▬❂▬●


═════ ═════

Previous Post Next Post