Which processes are legitimate?

Which processes are legitimate?
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Which processes are legitimate? SANTANDER 06-25-2008
Posted by Geoff on June 30, 2008, 7:46 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Mon, 30 Jun 2008 16:54:08 -0400, "David H. Lipman"

>
>| wrote:
>
>
>>>Just tried Process Explorer, does it show hidden DLLs that possibly can
>>>loaded inside explorer.exe process?
>
>
>| It shows every process. AFAIK, nothing can hide from it.
>
>
>That is NOT true. Many forms of malware can use low level Win32/Win64
programming
>constructs that can indeed hide the process form usitlities like Process
Explorer. This
>is where a anti RootKit utility such as Gmer is useful. Additionally, Process
Explorer
>will not identify files that are stored using the Alternate Data Streams (ADS)
>capabailities of NTFS.
>
Well, if you have specific info I'd like to see it. If it has a PID, it can
be seen. Rootkit Revealer found it. Not sure if Mark was using PE at the
same time when he found the Sony rootkit.

As for ADS, a process is not a file,to which part of PE are you referring
to about hiding a process in an ADS?

Posted by David H. Lipman on June 30, 2008, 8:11 pm
If you were  Registered and logged in, you could reply and use other advanced thread options


| Well, if you have specific info I'd like to see it. If it has a PID, it can
| be seen. Rootkit Revealer found it. Not sure if Mark was using PE at the
| same time when he found the Sony rootkit.

| As for ADS, a process is not a file,to which part of PE are you referring
| to about hiding a process in an ADS?

This is an area where I fall off the ledge. I still have much to learn.
However it is my
understanding the following are used to hide processes...

ZwCreateThread
ZwOpenProcess
ZwOpenThread
ZwTerminateProcess
ZwWriteVirtualMemory

The PID would be hidden from normal scrutiny and thus NOT shown in Process
Explorer.

You are correct in that ADS refers to how a file is stored and not a process.
However,
you can not tell from Process Explorer if a file is executed from an Alternate
Data
Stream. SVCHOST.EXE executed as an ADS is most certainly malware.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Posted by Geoff on June 30, 2008, 9:50 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Mon, 30 Jun 2008 20:11:32 -0400, "David H. Lipman"

>
>
>| Well, if you have specific info I'd like to see it. If it has a PID, it can
>| be seen. Rootkit Revealer found it. Not sure if Mark was using PE at the
>| same time when he found the Sony rootkit.
>
>| As for ADS, a process is not a file,to which part of PE are you referring
>| to about hiding a process in an ADS?
>
>This is an area where I fall off the ledge. I still have much to learn.
However it is my
>understanding the following are used to hide processes...
>
>ZwCreateThread
>ZwOpenProcess
>ZwOpenThread
>ZwTerminateProcess
>ZwWriteVirtualMemory
>
>The PID would be hidden from normal scrutiny and thus NOT shown in Process
Explorer.
>
>You are correct in that ADS refers to how a file is stored and not a process.
However,
>you can not tell from Process Explorer if a file is executed from an Alternate
Data
>Stream. SVCHOST.EXE executed as an ADS is most certainly malware.

Yes, kernel mode functions can get you places, but I am googling for how a
PID can be hidden and have not found it yet. It was my understanding that
PE used a KM technique to make it difficult for KM processes to hide from
it but I could be wrong. One of the first examples I found in a google
search for ZwOpenProcess had a sample that resisted process info probes
from PE but was not invisible to it.

ADS had to be one of the worst ideas ever. I still encounter ADS stripping
messages when I copy files from my company laptop to non-ntfs media.
Corporate IT insisted on using CA Antivirus and it tagged every file with
an ADS signature. What a waste.

Posted by David H. Lipman on June 30, 2008, 10:13 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

< snip >

| Yes, kernel mode functions can get you places, but I am googling for how a
| PID can be hidden and have not found it yet. It was my understanding that
| PE used a KM technique to make it difficult for KM processes to hide from
| it but I could be wrong. One of the first examples I found in a google
| search for ZwOpenProcess had a sample that resisted process info probes
| from PE but was not invisible to it.

| ADS had to be one of the worst ideas ever. I still encounter ADS stripping
| messages when I copy files from my company laptop to non-ntfs media.
| Corporate IT insisted on using CA Antivirus and it tagged every file with
| an ADS signature. What a waste.

I think ADS was added for Macintosh file support.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Posted by jen on July 1, 2008, 2:49 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> < snip >
> | Yes, kernel mode functions can get you places, but I am googling for
> how a
> | PID can be hidden and have not found it yet. It was my understanding
> that
> | PE used a KM technique to make it difficult for KM processes to hide
> from
> | it but I could be wrong. One of the first examples I found in a
> google
> | search for ZwOpenProcess had a sample that resisted process info
> probes
> | from PE but was not invisible to it.
> | ADS had to be one of the worst ideas ever. I still encounter ADS
> stripping
> | messages when I copy files from my company laptop to non-ntfs media.
> | Corporate IT insisted on using CA Antivirus and it tagged every file
> with
> | an ADS signature. What a waste.
> I think ADS was added for Macintosh file support.

File system forks are traditionally associated with Apple's Hierarchical
File System (HFS), but are also available in other file systems. In
Microsoft's NTFS they are known as Alternate Data Streams (ADS). Other
filesystems such as Novell's Novell Storage Services (NSS) and NetWare
File System (NWFS), Solaris's UFS (in Solaris 9 and later) and ZFS, and
Veritas Software's Veritas File System (VxFS) also support file system
forks. In Solaris they are known as extended attributes, although they
can be as large as a file and are accessed in the same way a file's data
is and thus behave like a fork. UDF, being a universal file system for
general data exchange, supports forks as well.

*In 1993, Microsoft released the first version of the Windows NT
operating system which introduced the NTFS filesystem. This filesystem
includes support for multiple named forks as alternate data streams for
compatibility with pre-existing operating systems that support forks.
With Windows 2000, Microsoft started using alternate data streams in
NTFS to store things such as author or title file attributes and image
thumbnails. With Service Pack 2 for Windows XP, Microsoft introduced the
Attachment Execution Service that stores details on the origin of
downloaded files in alternate data streams attached to files, in an
effort to protect users from downloaded files that may present a risk.
http://en.wikipedia.org/wiki/Fork_(filesystem)

-jen



Similar ThreadsPosted
Wierd Processes Running on Windows 2003 Servers July 16, 2006, 9:42 am

The site map in XML format XML site map

Contact Us | Privacy Policy