版權說明:本文檔由用戶提供并上傳,收益歸屬內容提供方,若內容存在侵權,請進行舉報或認領
文檔簡介
SEC309
AdvancedMalwareCleaningMarkRussinovichTechnicalFellow,PlatformandServicesDivisionMicrosoftCorporationmark.russinovich@AboutMeTechnicalFellow,MicrosoftCo-founderandchiefsoftwarearchitect
ofWinternalsSoftwareCo-authorofWindowsInternals,4theditionandInsideWindows2000,3rdEditionwithDavidSolomonAuthoroftoolson
HomeofblogandforumsSeniorContributingEditor,WindowsITProMagazinePh.D.inComputerEngineeringWhyIsManualCleaningNecessary?Howdousersgetmalware?Theydownloadappsthatincludeadwareandspyware
TheyclickonmisleadingpopupsorbannersTheyvisitsitesthatuseexploitstoinjectmalwareManyusersstilldon’tpatchordon’tuseantivirusorantispywareWhydoesn’tantivirusandantispywarestopmalware?TheyaredependentonsignaturesMalwaredirectlyattacksitAlwaysperformmanualcleaningafteryou’verunavailableantivirusandantispywareMalwareCleaningStepsDisconnectfromthenetworkIdentifymaliciousprocessesanddriversTerminateidentifiedprocessesIdentifyanddeletemalware
autostartsDeletemalwarefilesRebootandrepeatIdentifyingMalwareProcessesWhatAreYouLookingFor?Processesthat……h(huán)avenoicon…h(huán)avenodescriptionorcompanyname…unsignedMicrosoftimages…liveinWindowsdirectory…arepacked…includestrangeURLsintheirstrings…h(huán)aveopenTCP/IPendpoints…h(huán)ostsuspiciousDLLsorservicesWhatAboutTaskManager?TaskManagerprovideslittleinformationaboutimagesthatarerunningProcessExplorerProcessExploreris“SuperTaskManager”RunsonWindows95,98,Me,NT,2000,XP,Server2003Alsosupports64-bit(x64)andVistaHaslotsofgeneraltroubleshootingcapabilities:DLLversioningproblemsHandleleaksandlockedfilesPerformancetroubleshootingHungprocessesWe’regoingtofocusonitsmalwarecleaningcapabilitiesTheProcessViewTheprocesstreesortshowsparent-childrelationshipsIcon,description,andcompanynamearepulledfromimageversioninformationMostmalwaredoesn’thaveversioninformationWhataboutmalwarepretendingtobefromMicrosoft?We’lldealwiththatshortly…UsetheWindowFinder(inthetoolbar)toassociateawindowwithitsowningprocessUsetheGooglemenuentrytolookupunknownprocessesButmalwareoftenusestotallyrandomorpseudo-randomnamesRefreshHighlightingRefreshhighlightinghighlightschangesRed:processexitedGreen:newprocessChangeduration(default1second)inOptionsPressspacebartopauseandF5torefreshCausedisplaytoscrolltomakenewprocessesvisiblewithShowNewProcessesoptionProcess-typeHighlightsBlueprocessesarerunninginthesamesecuritycontextasProcessExplorerPinkprocesseshostWindowsservices(we’lllookatservicesshortly)Purplehighlightingindicatesanimageis“packed”PackedcanmeancompressedorencryptedMalwarecommonlyusespacking(e.g.UPX)tomakeantivirussignaturematchingmoredifficultPackingandencryptionalsohidesstringsfromviewThereareafewothercolors,butthey’renotimportantformalwarehuntingTooltipsProcesstooltipsshowthefullpathtotheprocessimageMalwaremoreoftenhidesbehindSvchostandRundll32TooltipforRundll32processesshowshostedDLLTooltipforserviceprocessesshowshostedservicesServicescoveredindetailshortly…DetailedProcessInformationDouble-clickonaprocesstoseedetailedinformationImage
tab:Description,companyname,version(from.EXE)FullimagepathCommandlineusedtostartprocessCurrentdirectoryParentprocessUsernameStarttimeImageVerificationAll(well,most)MicrosoftcodeisdigitallysignedHashoffileissignedwithMicrosoft’sprivatekeySignatureischeckedbydecryptingsignedhashwiththepublickeyYoucanselectivelycheckforsignatureswiththeVerifybuttonontheprocessimagetabSelecttheVerifyImageSignaturesoptiontocheckallAddtheVerifiedSignercolumntoseeallNotethatverificationwillconnecttotheInternettocheckCertificateRevocationList(CRL)serversWindowsServicesServicescanstartwhenthesystembootsandrunindependentlyofthelogged-onuserExamplesincludeIIS,Themes,Server,Workstation,…CanrunastheirownprocessorasaserviceDLLinsideaSvchost.exeTheservicestabshowsdetailedserviceinformation:Registryname(HKLM\System\CurrentControlSet\Services\...)DisplaynameDescription(optional)DLLpath(forSvchostDLLs)StringsOn-diskandin-memoryprocessstringsarevisibleontheStringstabThere’sonlyadifferenceiftheimageiscompressedorencryptedStringscanhelpprovidecluesaboutunknownprocessesLookforURLs,namesanddebugstringsYoucanalsodumpstringswiththecommand-lineStringsutilityfromSysinternalsTheDLLViewMalwarecanhideasaDLLinsidealegitimateprocessWe’vealreadyseenthiswithRundll32andSvchostTypicallyloadsviaanautostartCanloadthrough“dllinjection”PackinghighlightshowsinDLLviewaswellOpentheDLLviewbyclickingontheDLLiconinthetoolbarShowsmorethanjustloadedDLLsIncludes.EXEandany“memorymappedfiles”CansearchforaDLLwiththeFinddialogDLLstringsarealsoviewablefromtheDLLmenu`LoadedDriversThereareseveraltoolsforviewingconfigureddrivers:Start->Run->Msinfo32BuiltinSCcommand:scquerytype=driverDeviceManagerwithView->ShowHiddenDevicesProcessExplorerDLLviewfortheSystemprocessshowsloadeddriversEvendriversthatdeletetheirimagefilesSamepathandversioninfoasstandardDLLviewSimplyidentifythemnowUsuallythey’renotstoppableDeletetheirfilesandautostartsettingslaterTCPViewLookforsuspiciousnetworkendpointswithTCPViewYoucandothisbylookingattheTCP/IPtabofeachprocess,butthat’sslowTCPViewalsousesrefreshhighlightingTCPViewincludesa“closeconnection”capability…butyoushouldbedisconnectedfromthenetworkTerminatingMaliciousProcessesDon’tkilltheprocessesMalwareprocessesareoftenrestartedbywatchdogsInstead,suspendthemNotethatthismightcauseasystemhangforSvchostprocessesRecordthefullpathtoeachmaliciousEXEandDLLAftertheyareallasleepthenkillthemWatchforrestartswithnewnames…CleaningAutostartsInvestigatingAutostartsWindowsXPMsconfig(Start->Run->Msconfig)fallsshortwhenitcomestoidentifyingautostartingapplicationsItknowsaboutfewlocationsItprovideslittleinformationAutorunsShowseveryplaceinthesystemthatcanbeconfiguredtorunsomethingatboot&logonStandardRunkeysandStartupfoldersShell,userinitServicesanddriversTasksWinlogonnotificationsExplorerandIEaddins(toolbars,BrowserHelperObjects,…)Moreandevergrowing…EachstartupcategoryhasitsowntabandallitemsdisplayontheEverythingtabStartupname,imagedescription,companyandpathIdentifyingMalware
AutostartsZoom-inonadd-ons(includingmalware)byselectingtheseoptions:VerifyCodeSignaturesHideMicrosoftEntriesSelectanitemtoseemoreinthelowerwindowGoogleunknownimagesDouble-clickonanitemtolookatwhereitsconfiguredintheRegistryorfilesystemHasotherfeatures:CandisplayotherprofilesCanalsoshowemptylocations(informationalonly)IncludescomparefunctionalityIncludesequivalentcommand-lineversion,Autorunsc.exeDeletingAutostartsDeletesuspiciousautostartsYoucandisablethemifyou’renotsureAfteryou’redonedoafullrefreshIftheycomeback,runProcessMonitor(orFilemonandRegmon)toseewho’sputtingthembackYoumighthavemisidentifiedamalwareprocessItmightbeahidden,system,orlegitimateprocessRootkitsWhat’saRootkit,Anyway?HoglundandButlerwritein“Rootkits:SubvertingtheWindowsKernel”: Arootkitisasetofprogramsandcodethatallowsapermanentorconsistent,undetectablepresenceonacomputer.
Mydefinition: Softwarethathidesitselforotherobjects,suchasfiles,processes,andRegistrykeys,fromviewofstandarddiagnostic,administrative,andsecuritysoftware.Hoglund’sreviseddefinitionfromRonFebruary4: Arootkitisatoolthatisdesignedtohideitselfandotherprocesses,data,and/oractivityonasystem.TheEvolutionofMalwareMalware,includingspyware,adwareandviruseswanttobehardtodetectand/orhardtoremoveRootkitsareafastevolvingtechnologytoachievethesegoalsCloakingtechnologyappliedtomalwareNotmalwarebyitselfExamplerootkit-basedviruses:W32.Maslan.A@mm,W32.Opasa@mmRootkithistoryAppearedasstealthvirusesOneofthefirstknownPCviruses,Brain,wasstealthFirst“rootkit”appearedonSunOSin1994Replacementofcoresystemutilities(ls,ps,etc.)tohidemalwareprocessesModernRootkitsRootkitscanhidevirtuallyanything:ProcessesFiles,directories,RegistrykeysServices,driversTCP/IPportsThereareseveraltypesofrootkittechnology:User-modehookingKernel-modehookingCodepatchingHidinginotherprocessesistheprimaryrootkitforumExampleRootkitCloakingAttackuser-modesystemqueryAPIsExamples:HackerDefender,AfxTaskmgr.exeNtdll.dllRootkitExplorer.exe,
Winlogon.exeusermodekernelmodeExplorer.exe,Malware.exe,Winlogon.exeRootkitDetectionAllcloakshaveholesLeavesomeAPIsunfilteredHavedetectablesideeffectsCan’tcloakwhenOSisofflineRootkitdetectionattacksholesCat-and-mousegameRootkitDetectionTypesThreeclassesofrootkitdetection:SignaturebasedMicrosoftMaliciousSoftwareRemovalToolAnomalydetectionSystemVirginityVerifier:http:///tools.htmlGMER:http:///index.phpIceSword:/tools/200509/IceSword_en1.12.rarCross-viewcomparisonF-SecureBlacklight:
/blacklight/Sysinternals
RootkitRevealerUsemorethanonetool!RootkitRevealerRootkitRevealer(RKR)runsonlineRKRtriestobypassrootkittouncovercloakedobjectsAllcross-viewdetectorslisteddothesameRKRscansHKLM\Software,HKLM\SystemandthefilesystemPerformsWindowsAPIscanandcompareswithrawdatastructurescanRootkitRevealerRootkitWindowsAPIRawfilesystem,
RawRegistryhiveFilteredWindowsAPIomitsmalwarefilesandkeysMalwarefilesandkeys
arevisibleinrawscanRootkitRevealerLimitationsRootkitshavealreadyattackedRKRdirectlybynotcloakingwhenscannedRKRisgiventruesystemviewWindowsAPIscanlookslikerawscanWe’vemodifiedRKRtobeahardertodetectbyrootkitsRKRisadoptingrootkittechniquesitselfRootkitauthorswillcontinuetofindwaysaroundRKR’scloakIt’sagamenobodycanwinAllrootkitdetectorssufferthesamevulnerabilityLocalKernelDebuggingWindbgsupports“l(fā)ocalkerneldebugging”(LKD)WorkslikestandardkerneldebuggingwhichrequirestwocomputersRequiresMicrosoftDebuggingToolsForWindows(freedownloadfromMicrosoft)CanexaminekernelstructuresofalivesystemSupportedonXPandhigherincluding64-bitForNT4andWindows2000useSysinternals’Livekd
BothrequirematchingkernelsymbolsUseMicrosoft’ssymbolserver(documentedinhelpfile)LKDRootkitHuntingListrunningprocessesandcomparewithProcessExplorer:!process00ListloadeddriversandcomparewithProcessExplorer:.reloadlmkvLookforkernelhot-patches:!chkimg-dntDumpthesystemservicetableandinterruptdispatchtable(IDT):dd
kiservicetable!idt-aFindingandDeletingMalwareFilesSigcheckScanthesystemforsuspiciousexecutableimagesLookforsamecharacteristicsassuspiciousprocessesBeespeciallywaryofitemsinthe\WindowsdirectoryInvestigateallunsignedimagessigcheck-e-u-sc:\DeletingHard-to-DeleteFilesFilesthatareopenormappedcan’tbedeletedFindowningprocesswithProcessExplorersearchTerminatetheprocessanddeletethefileIfyoustillcan’tdeleteit(itmightbeprotectedbyadriverorsystemprocess):TryrenamingitIfthatfails,scheduleitfordeletionatthenextrebootwithSysinternals’Movefile:Ifitstillwon’tgoaway,deleteitfromanoff-lineOSmovefile
malware.exe“”DeletingHard-to-DeleteRegistryKeysWatchforkeysecuritySomeantispywaretoolsdon’treportaccess-deniederrorsUseRegmontocheckforerrorsUseRegedittochangesecuritypermissionsSomekeyshave
溫馨提示
- 1. 本站所有資源如無特殊說明,都需要本地電腦安裝OFFICE2007和PDF閱讀器。圖紙軟件為CAD,CAXA,PROE,UG,SolidWorks等.壓縮文件請下載最新的WinRAR軟件解壓。
- 2. 本站的文檔不包含任何第三方提供的附件圖紙等,如果需要附件,請聯(lián)系上傳者。文件的所有權益歸上傳用戶所有。
- 3. 本站RAR壓縮包中若帶圖紙,網頁內容里面會有圖紙預覽,若沒有圖紙預覽就沒有圖紙。
- 4. 未經權益所有人同意不得將文件中的內容挪作商業(yè)或盈利用途。
- 5. 人人文庫網僅提供信息存儲空間,僅對用戶上傳內容的表現(xiàn)方式做保護處理,對用戶上傳分享的文檔內容本身不做任何修改或編輯,并不能對任何下載內容負責。
- 6. 下載文件中如有侵權或不適當內容,請與我們聯(lián)系,我們立即糾正。
- 7. 本站不保證下載資源的準確性、安全性和完整性, 同時也不承擔用戶因使用這些下載資源對自己和他人造成任何形式的傷害或損失。
最新文檔
- 2024年海洋潛標系統(tǒng)項目建議書
- 2024年超高速電路項目發(fā)展計劃
- 2024年特種加工機床項目建議書
- 老年公寓招商策劃方案
- 2024年酒及飲料加工機械項目發(fā)展計劃
- 2024年專業(yè)服務項目合作計劃書
- 2024年東蘭縣數(shù)學六年級第一學期期末質量檢測模擬試題含解析
- 幼兒園中班數(shù)學公開課教案《按圖形的特征分類》及教學反思
- 幼兒園中班教案《學習10以內的單雙數(shù)》含反思
- 2024年衛(wèi)星支架、分配器合作協(xié)議書
- 新老管線對接施工方案
- 消防工程施工進度計劃表(共6頁)
- 標識牌項目經濟效益分析(模板范文)
- 中國民間古典擇日
- 保健品的價格策略
- 20版藥典中藥材和飲片中33種農殘檢測指標
- 網吧公司章程
- 養(yǎng)老院行政值班記錄表
- (完整版)武警營房施工方案
- 沉井施工技術交底(完整版)
- 廣告牌拆除方案(完整版)
評論
0/150
提交評論