24 August 2007
My brother's rootkit woes
My brother's wife's laptop had started redirecting IE to http://hp-desktop.aol.com/. Changing the Home Page to anything else failed in all attempts and failed insidiously when he manually changed through the registry: within a second, the old value was returned. I was at first puzzled as to why a rootkit would redirect to an apparently innocuous site but realized that redirecting to a spammy site would be too obvious.
Jeff Atwood over at Coding Horror had recently detailed his unfunny exploits with cleaning up a spyware infestation and his assessment of the state of Windows security re rootkits. Both, along with their discussion threads, are valuable reading. His three dictums on security:
- Stop Running As Administrator
- Traditional Anti-Virus Doesn't Work Any More
- The Mainstreaming of Virtual Machine Sandboxes
WRT rootkits, the standard recommendation is always RootkitRevealer from Sysinternals. It's a raw interface that merely points to possible problems and offers no recommendations, but it comes from a reputable source. Google should be enough to find follow-up info anyway. An Information Week article recommended the freeware tool RootKit-Unhooker. Despite its oddly inconsistent CamelCase, it looks like a good tool.
On the infected laptop, RootkitRevealer revealed one item of suspicion: HKLM\SOFTWARE\Microsoft\Window\CurrentVersion\MSSYCLM\Start. A search on "MSSYCLM" brought up the thread "Topic: ACEWSUWMB.EXE" at Sysinternals. It could be a false positive, but it could also be owned by the Winhound adware/malware.
He's still deciding whether to try to remove, re-image, or (god forbid) ignore.
- Posthuman dystopia posted by sstrader on 22 March 2015 at 10:21:25 AM
- Today's reading list posted by sstrader on 19 January 2014 at 12:10:54 PM
- Closing posted by sstrader on 18 January 2014 at 9:51:27 AM
- Info wars 2010 posted by sstrader on 13 February 2010 at 11:50:50 AM
- Limiting noise posted by sstrader on 15 December 2009 at 9:58:00 AM