Author Topic: 4 Rootkits, cant check them if these files are bad/good  (Read 7344 times)

Offline w-e-v

  • Star Group
  • Comodo's Hero
  • *****
  • Posts: 1346
  • BETA FORCE MEMBER
4 Rootkits, cant check them if these files are bad/good
« on: February 14, 2012, 12:05:43 PM »
Hello:

I did a smartscan and in less than 15 minutes it finished founding 4 threats which are rootkits (according to CIS):
Code: [Select]
2012-02-14 10:46:14  c:\WINDOWS\$NtUninstallKB12472$\1140427966\L\jhvoizqb  Rootkit.HiddenFile[at]0
2012-02-14 10:46:15  c:\WINDOWS\$NtUninstallKB12472$\1140427966\L  Rootkit.HiddenFolder[at]0
2012-02-14 10:46:15  c:\WINDOWS\$NtUninstallKB12472$\1140427966\[at]  Rootkit.HiddenFile[at]0
2012-02-14 10:46:15  c:\WINDOWS\$NtUninstallKB12472$\1140427966\U  Rootkit.HiddenFolder[at]0

Im not able to send this files to Valk, VirusTotal or Anubis, since I cannot locate them with Windows Explorer.
Its like the files dont exist. But they are always detected by CIS.

So how or what can I do to test these to see if they are bad or if they are just false-positives?

Offline w-e-v

  • Star Group
  • Comodo's Hero
  • *****
  • Posts: 1346
  • BETA FORCE MEMBER
Re: 4 Rootkits, cant check them if these files are bad/good
« Reply #1 on: February 15, 2012, 01:53:45 PM »
CAV found other 2 threats:

Code: [Select]
C:\System Volume Information\_restore{2AC3F150-276E-41FC-B419-EEE0635F846E}\RP142\A0023198.data|7.eml|Setup_NIS05.exe
C:\System Volume Information\_restore{2AC3F150-276E-41FC-B419-EEE0635F846E}\RP142\A0023198.data|10.eml|Setup_NIS05.exe

Due to the location of all files (included in the previous post), I am not allowed to access those system folders (due to system permissions/restrictions). Thus, I cannot upload to Valkyrie, VirusTotal or any other online scanner.

Any idea how can I achieve that to report all this as false-positives or suspicious?
I think COMODO should allow the upload of the found threats within the CAV-UI, since they are already identified and located.

Online wasgij6

  • Volunteer Moderator
  • Global Moderator
  • Comodo's Hero
  • *****
  • Posts: 3970
Re: 4 Rootkits, cant check them if these files are bad/good
« Reply #2 on: February 15, 2012, 02:33:05 PM »
try enabling "show hidden files and folders" and unchecking "hide protected operating system files" in the folder optioms. take extreme caution when unchecking the second option. it would be best to recheck it once ur done.
| Win 8.1 Pro (x64) | UAC Disabled | Intel i7 4770k | Asus Maximus VI Formula Mobo | Asus GeForce GTX 780 | G.Skill TridentX 16gb RAM | Samsung 840 Pro SSD |

Offline w-e-v

  • Star Group
  • Comodo's Hero
  • *****
  • Posts: 1346
  • BETA FORCE MEMBER
Re: 4 Rootkits, cant check them if these files are bad/good
« Reply #3 on: February 15, 2012, 03:19:14 PM »
I did that already before, and it showed the folders... but like I said I cant enter the folders.
For example with this:
Code: [Select]
C:\System Volume Information\_restore{2AC3F150-276E-41FC-B419-EEE0635F846E}\RP142\A0023198.data|7.eml|Setup_NIS05.exe
I can navigate to C: and I can see the folder "System Volume Information".
But when I double click there, I get the following message: YOU CANT ACCESS SYSTEM VOLUME INFORMATION. ACCESS DENIED.

I cannot navigate within that folder neither with valkyrie software, nor with other application. :(

Offline Radaghast

  • Star Group
  • Comodo's Hero
  • *****
  • Posts: 4068
Re: 4 Rootkits, cant check them if these files are bad/good
« Reply #4 on: February 15, 2012, 04:01:53 PM »
To access SysVol, modify the permissions on the folder and give your account full control permissions.
« Last Edit: February 15, 2012, 04:38:33 PM by Radaghast »
“Don’t worry if it doesn’t work right. If everything did, you’d be out of a job.”

Offline w-e-v

  • Star Group
  • Comodo's Hero
  • *****
  • Posts: 1346
  • BETA FORCE MEMBER
Re: 4 Rootkits, cant check them if these files are bad/good
« Reply #5 on: February 15, 2012, 09:19:44 PM »
Machine is running Windows XP Home edition.
It doesnt have such feature to modify the permissions on the folder.

Offline Radaghast

  • Star Group
  • Comodo's Hero
  • *****
  • Posts: 4068
Re: 4 Rootkits, cant check them if these files are bad/good
« Reply #6 on: February 15, 2012, 10:30:20 PM »
Machine is running Windows XP Home edition.
It doesnt have such feature to modify the permissions on the folder.

You should be able to access the advanced security tab in safe mode. Failing that, use the Cacls command.
« Last Edit: February 15, 2012, 11:06:45 PM by Radaghast »
“Don’t worry if it doesn’t work right. If everything did, you’d be out of a job.”

Offline w-e-v

  • Star Group
  • Comodo's Hero
  • *****
  • Posts: 1346
  • BETA FORCE MEMBER
Re: 4 Rootkits, cant check them if these files are bad/good
« Reply #7 on: February 15, 2012, 11:27:56 PM »
You should be able to access the advanced security tab in safe mode.

Thank you! It worked! :D


I keep thinking this submission procedures should be a easy menu option available once the user is reviewing the files detected by CIS.

Offline jay2007tech

  • Malware Research Group
  • Global Moderator
  • Comodo's Hero
  • *****
  • Posts: 2013
Re: 4 Rootkits, cant check them if these files are bad/good
« Reply #8 on: March 06, 2012, 11:08:16 PM »
Same scenario as above, but for windows 7
enabling "show hidden files and folders" and unchecking "hide protected operating system files" in the folder optioms. take extreme caution when unchecking the second option. it would be best to recheck it once ur done.

then add  "Take ownership" option to it.  Click on the .reg file that I had available

Now Find the problem you had in that case if you had windows 7
C:\System Volume Information  <----right click on it, and click on "take ownership"
some screens will pop up and go away.  Now you can access it and do what you want to it :)
It's hard being a crooked Admin when the files won't pass an md5checksum test.  But like any other good crooked Admin it can be done, it just takes time(and lots of it) and a few aspirins

 

Seo4Smf 2.0 © SmfMod.Com | Smf Destek