RU77472U1 - RUTKIT DETECTION AND TREATMENT SYSTEM - Google Patents

Abstract

The utility model relates to antivirus tools and more specifically to rootkit detection tools. The technical result is to increase the detection efficiency of the presence of a rootkit in a computer system. The system includes a tool for creating the first image for the selected operating system and registry files, while this tool is configured to create the first image after loading the boot drivers, but before loading all the other drivers; means for permanently storing the first image obtained by said means for creating the first image; means for creating a second image for the selected files of the operating system and registry, which is created after loading all the remaining drivers; means for comparing the first image obtained from said permanent storage means and the second image obtained from the means for creating the second image; means for issuing a message to the user about a rootkit infection of the computer according to the comparison results received from the said means of comparison, while the means for issuing a message is configured to issue this message in case of inequality of the first and second images.

Description

Technical field

The present utility model relates to computer systems and more particularly to a system for detecting and treating rootkits.

State of the art

A rootkit is a set of software that is often used by outsiders (usually an attacker) in order to gain access to a computer system and hide running processes, files, or system data that allow an attacker to have access to the system if the user does not know about it. It is known at the moment that rootkits exist on various operating systems, such as Linux, Solaris, and various versions of Microsoft Windows. A rootkit infected computer is often referred to as a rootkit.

The term rootkit itself (also spelled rootkit) originally refers to a set of recompiled Unix commands, such as

"ps", "netstat", "w" and "passwd", which carefully hide any traces of the attacker that these commands usually display. Thus, an attacker can have root access in the system, while the system administrator will not have the slightest idea about this. Now this term already refers not only to Unix systems, since there are commands that perform similar functions not only for Unix systems, but also, for example, for Microsoft Windows (even if these operating systems do not have root access).

A rootkit usually hides logins, processes, trades, registry keys, files and logs, and may also include various software to intercept data from terminals, network connections, and from the keyboard.

Rootkits come in three different types: kernel-level rootkits, libraries, and applications. Kernel-level rootkits add additional code and / or replace part of the kernel code with their own code in order to hide illegal access to the system. This is often done by adding new code to the kernel using a device driver or boot module, such as loadable kernel modules on Linux or device drivers on Microsoft Windows. Library-level rootkits usually modify or replace system calls with those that hide information about the intruder. Application-level rootkits can replace regular executables with fakes with trojans, or they can change the functionality of existing ones using various patches, embedded parts of the code, etc. Kernel-level rootkits can be especially dangerous, since they are difficult to detect without the appropriate software.

Rootkits are usually stored on disk for activation after a system restart and are hidden to the operating system during requests to the file system. Rootkits are difficult to detect for the reason that they are activated before the operating system is fully loaded, while often allowing you to install hidden files, processes and user accounts in the operating system. Rootkits are usually integrated into operating system processes in a similar way to filters, which prevents conventional detection tools from finding hidden software.

One of the difficulties of detecting rootkits is the fact that, unlike viruses, rootkits usually activate themselves when the operating system boots up, while rootkits themselves acquire system privileges. Rootkits also take steps to hide their presence so that traditional antivirus engines cannot detect them. For example, a typical antivirus program makes a call to a system function to recognize running processes. The rootkit intercepts this call and returns to the antivirus its list of processes where the rootkit process itself is absent. In addition, the rootkit usually hides the files in which it is stored from traditional anti-virus mechanisms that scan files using virus signatures. In other words, the files in which the rootkit is stored are never scanned by the antivirus, which makes the detection and treatment of rootkits especially difficult.

Within the Microsoft Windows operating system, the rootkit works by intercepting system calls (through the so-called Windows API or application programming interface).

Intercepting and modifying low-level API functions is a mechanism that uses a rootkit to hide its presence in the system. Moreover, a rootkit can hide the presence of any description in the system in the process settings, files and folders, registry keys, etc. Many rootkits include their own drivers and services in the system, which also turn out to be hidden. US patent 7032114 describes a method for detecting a rootkit, which compares the initial and final sample of the system in order to detect the presence of a rootkit in it.

Publication US 2006/0168352 describes a standard approach to treating a network node, where the initial and subsequent image of the system, made after a reboot, is formed, after which these images are compared.

US 6792556 describes a standard approach to detecting viruses and recovering a computer after a virus infection at boot time. In this method, a system image is made, which is saved to a file. After that, during system boot, boot records are compared with the system image read from the file. After comparison - if a virus is detected - then the system is restored from the original safe image. Moreover, in the framework of this patent, checksums can be used when creating the image.

However, most standard systems cannot be used to detect rootkits due to their features. Moreover, most standard systems do not guarantee the detection of most rootkits that hide their presence, even if signature comparison is used.

Therefore, the technical result of this utility model is to provide a system that provides more efficient rootkit detection.

Utility Model Essence

Accordingly, the present utility model relates to a system for detecting rootkits that eliminate one or more disadvantages of the related art.

A system for detecting a rootkit on a computer, which contains: means for creating the first image for the selected files of the operating system and registry, while this tool is configured to create the first image after loading the boot drivers, but before loading all other drivers; means for permanently storing the first image obtained by said means for creating the first image; means for creating a second image for the selected files of the operating system and registry, which is created after loading all the remaining drivers; means for comparing the first image obtained from said permanent storage means and the second image obtained from the means for creating the second image; means for issuing a message to the user about a rootkit infection of the computer according to the comparison results received from the said means of comparison, while the means for issuing a message is configured to issue this message in case of inequality of the first and second images.

In a private embodiment, dedicated files also include system services.

In another private embodiment, the operating system is WINDOWS.

In another particular embodiment, the WINDOWS operating system can be either 32 or 64-bit.

In another particular embodiment, said means for creating the first image is configured to create the first image after detecting the SERVICE_BOOT_START flag.

In another particular embodiment, said means for creating the first image and said means for creating the second image are configured to create the first and second images, respectively, using the key HKLM \ SYSTEM \ CurrentControlSet \ Control \ SessionManager \ BootExecute.

Brief description of the attached drawings

The accompanying drawings, which are included here to provide an additional understanding of the utility model, are included in and constitute part of this description showing embodiments of the utility model, and together with the description, serve to explain the operating principles of the utility model.

Figure 1 shows a diagram that illustrates a possible embodiment of a utility model.

On figa and 2b shows a diagram of the creation and use of images.

Figure 3 shows a block diagram of the claimed system.

Detailed Description of Preferred Embodiments

Reference will now be made to detailed preferred embodiments of the present utility model, examples of which are shown in the accompanying drawings.

As noted above, almost all modern computers use operating systems to control various functions. At the moment, the most popular operating system is Microsoft Windows, many versions of which include Windows NT 4.0, Windows 2000, Windows 2003, Windows XP (including the 64-bit version). Windows Vista (including 64-bit), Windows CE, Xbox OS, etc. This utility model is designed to work in at least all current and future versions of the Microsoft Windows operating system. It should also be understood by a person skilled in the art that the ideas described herein can also be applied to other operating systems.

As already mentioned, the Windows operating system is vulnerable to rootkit infection, therefore the approach to solving the problem of rootkit detection in this system is described below.

Creating an image usually involves copying sector by sector of the whole file system, i.e. all service information and data. If the file system is currently active, then the copied files can be changed during copying, and some files can be opened for editing or

vice versa closed. In the simplest case, operations with the entire file system are suspended for a certain period of time and at this time an image is created. Of course, this approach does not apply to servers that constantly use their file systems.

As shown in figure 3, which shows a block diagram that illustrates a possible embodiment of the utility model. The proposed system comprises means 301 for creating the first image for the selected files of the operating system and registry, means 302 for permanently storing the first image obtained by means 301 for creating the first image; means 303 for creating a second image for the selected files of the operating system and registry, which is created after loading all the remaining drivers; means 304 for comparing the first image obtained from said permanent storage means 302 and the second image obtained from the second image creating means 303; means 305 for issuing a message to the user about infection with a rootkit according to the comparison results obtained from said comparison means 304.

Means 305 for issuing a message issues this message in case of inequality of the first and second images. In this case, the inequality of the first and second images means the discovery of hidden files and registry branches, i.e. the presence of a rootkit in the computer.

In addition, it should be noted that the tool 301 is configured to create the first image after loading the boot drivers, but before loading all the other drivers, namely, after the SERVICE_BOOT_START flag is detected.

Figure 1 shows the algorithm of the claimed system. At step 102, the process of loading the operating system on the computer begins. At 104, boot drivers are loaded. Boot drivers are device drivers that provide a minimum level of functionality - these are drivers for the graphics adapter, keyboard, mouse, and hard drive. At step 106, the tool 301 creates a first image. Tool 301 is designed to operate at the zero level of Intel processors after starting the system, loading drivers, and starting services. Services on the Microsoft Windows operating system are analogous to daemons on the UNIX system. The obtained first image from the means 301 is transferred to the means 302 for permanent storage.

At step 108, the operating system completes the boot process, and just at that moment, the rootkit has the ability to perform its own initialization. At step 110, means 303 creates a second image, which is compared in means of comparison 304 with the first image obtained from means 302, at step 112. If means 304 determines that the images are identical, then at step 114, message issuing means 305 concludes that rootkit computer and informs the user about it. In the event that the images do not match, then the tool 305 displays a message about the presence of a rootkit in the computer and, at step 116, the computer restarts. At step 118, boot drivers are loaded, and after that, at step 120, tool 301 creates a new first system image. At step 122, rootkit treatment occurs and the process returns to step 108.

As shown in figure 1, the first image of the operating system is created at the moment when the boot driver with the SERVICE_BOOT_START flag is loaded, but before the system services with the SERVICE_SYSTEM_START flag are started. That is, the first image is created before the Win32 subsystem is launched. It is also worth noting that the first image is formed using the key HKLM \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ PendingFileRenameOperation.

This image includes at least registry branches that are responsible for launching drivers, deleting and renaming files (for example, HKLM \ System \ CurrentControlSet \ Services), calculating the checksum of files, etc. It will also become apparent to a person skilled in the art that other information may also be included in the image.

After creating the first image of the system, it is saved using the means 302 for permanent storage, such as a hard disk, flash memory, tape, DVD disc, etc. After loading the operating system, you can create an image of its current state. The second image of the system is created in the same way as the first, and should contain the same data - if the rootkit did not infect the operating system. Once the second image of the system is created, it can be compared with the first and based on the comparison, a conclusion can be drawn. If there are no differences between the images, then the system does not have a rootkit and it can boot further. The difference between the images indicates that the system is infected with a rootkit and can be restored, for example, from a previously created safe copy.

As an option, in the interval between the creation of the first and second images, you can use the log with a list of downloaded ones,

changed and / or deleted files, as well as a list of changed registry values. The log might look like this:

[time] Explorer.EXE - create section for execute <path> \ avp.exe - SUCCESS

[time] Explorer.EXE [pid] - Process Create: <path> \ avp.exe [pid] - SUCCESS

[time] avp.exe [pid] - Thread Create [tid] - SUCCESS

[time] avp.exe [pid] - RegSetValue -

Key: "HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run", Value "avp",

Type: REG_SZ, Data: "<path> \ avp.exe" - SUCCESS

The means 301 and 303 for creating the first and second images can create an image using checksums, hashes, or other similar one-way functions. Each driver, for example, is usually stored as a file available to the operating system. A checksum (e.g., hash) can be generated by these tools 301 and 303 for each such driver file. Note that if one-way functions such as hash functions or other cryptographic functions are used, the checksums are securely encrypted, and only the user himself has the key for subsequent comparison or image creation. Table 1 below shows an example image with 4 drivers labeled A1-A4, corresponding files for drivers labeled FA1-FA4, and 4 corresponding checksums labeled HA1-HA4:

Driver name Driver file name Driver File Checksum A1 FA1 HA1

A2 FA2 ON 2 A3 FA3 HA3 A4 FA4 HA4

If the second image has the same values ON 1-HA4, then the comparison tool 304 may conclude that the operating system is not infected with a rootkit and may continue the boot process.

But another situation arises when the second image is different from the first, as, for example, in the table below:

Driver name Driver file name Driver File Checksum A1 FA1 HA1 A4 FA4 HA4 '(HA4'! = HA4)

As you can see from this image, the A2 and A3 drivers are either deleted or hidden, and the FA4 file containing the A4 driver has been changed. In this case, there is a high probability that a rootkit infection has occurred, and you need to load the operating system from a previously created safe copy.

Example image 1 ':

Driver name Driver file name Driver File Checksum A1 FA1 HA1

A3 FA3 HA3 A4 FA4 HA4 '

Comparing the results of images 1, 2, and 1 ', the comparison tool 304 can conclude that the A2 driver was really deleted, the A4 driver file was changed, and the A3 driver hides the fact of its presence in the system and, therefore, this is almost certainly a rootkit. You must remove the driver from the registry, and the corresponding file must either be deleted or quarantined.

In the above example, only 4 drivers are shown, although it should be clear to a person skilled in the art that the utility model is not limited to 4 drivers and that any number of drivers can be similarly operated.

Figa and 2b show in the form of diagrams the creation and use of images. As shown in FIG. 2a, a portion of the memory is allocated to the computer, usually referred to as the kernel space in which the operating system with drivers and services are located. The core space is designated as 202 in FIG. 2a. Typically, based on Intel architecture, code that runs in kernel space runs at level zero. The level scheme in Intel architecture looks like 0-1-2-3, where zero is the most privileged.

As shown in FIG. 2a, kernel space 202 contains code for various services 240, registry 218, and boot drivers 206. The source application discussed above is also located in kernel space 202. Boot drivers 206 are used to interact with network card 224 , monitor 226, keyboard 228, and mouse 230. The original application uses driver files 222, which are usually stored on the local hard drive or other data storage, to generate checksums 216. To generate checksums 216, the I register 218. All together, this makes image data 1, which is formed by means of the creation of the first image 301.

Fig. 2b shows a situation where a rootkit 208 is present in the system. Two applications, 216A and 216N, which work in the so-called user space or at the third level, are also shown there. Rootkit 206 makes changes to the registry 204, file system 210, and possibly other parts of the computer system. After calculating the checksums and creating the second image 214 using the first image creating means 301 and the second image creating means 303, the comparison tool 304 can compare (as shown in 232) two resulting images, image 1 and image 2, using bitwise or byte comparison. As a result of this comparison, you can detect hidden files and thereby detect the presence of rootkit 208 in the system.

The following is a typical set of files specific to the Win32 operating system:

Registry branches:

HKCR \ exefile \ shell \ open \ command

HKCR \ exefile \ shell \ runas \ command

HKCR \ comfile \ shell \ open \ command

HKCR \ comfile \ shell \ runas \ command

HKCR \ piffile \ shell \ open \ command

HKCR \ piffile \ shell \ runas \ command

HKCR \ batfile \ shell \ open \ command

HKCR \ batfile \ shell \ runas \ command

HKCR \ htafile \ shell \ open \ command

HKCR \ htafile \ shell \ runas \ command

HKCR \ cmdfile \ shell \ open \ command

HKCR \ cmdfile \ shell \ runas \ command

HKCR \ scrfile \ shell \ open \ command

HKCR \ scrfile \ shell \ runas \ command

HKCR \ txtfile \ shell \ open \ command

HKCR \ txtfile \ she] l \ runas \ command

HKCR \ regfile \ shell \ open \ command

HKCR \ regfile \ shell \ runas \ command

HKCR \ * file \ shell \ open \ command

HKCR \ * file \ shell \ runas \ command

* \ Software \ Microsoft \ Windows NT \ Current Version \ AEDebug \ Debugger

* \ Software \ Microsoft \ Windows NT \ Current Version \ Winlogon \ Shell

* \ Software \ Microsoft \ Windows NT \ Current Version \ Winlogon \ UserInit

* \ Sofbvare \ Microsoft \ Windows NT \ Currcnt Version \ Windows \ Run

* \ Software \ Microsoft \ Windows * \ Current Version \ Windows \ Load

* \ SOFTWARE \ Microsoft \ Windows NT \ Current Version \ Winlogon \ Taskman

* \ SOFTWARE \ Microsoft \ Windows NT \ Current Version \ Winlogon \ System

* \ SOFTWARE \ Microsoft \ Windows NT \ Current Version \ Winlogon \ Notify \ * \ DllName

* \ Software \ Microsoft \ Windows * \ Current Version \ Run * \ *

HKCU \ Software \ Mirabilis \ ICQ \ Agent \ Apps \ *

HKLM \ System \ Control Set ??? \ Services \ * \ Parameters \ Service Dll

HKLM \ System \ Control Set ??? \ Services \ * \ Image Path

HKLM \ System \ Control Set ??? \ Services \ VXD \ * \ Static VxD

HKLM \ system \ control set ??? \ control \ Session Manager \ Boot Execute

HKLM \ System \ control set ??? \ Control \ MPRServices \ * \ DLL Name

HKLM \ System \ Current Control Set \ Services \ VXD \ * \ Static VxD

HKLM \ system \ Current control set \ control \ Session Manager \ Boot Execute

HKLM \ System \ Current Control Set \ Control \ MPR Services \ * \ DLL Name

HKLM \ Software \ Microsoft \ Active Setup \ Installed Components \ * \ StubPath

HKLM \ Software \ Microsoft \ Windows NT \ Current Version \ WOW \ BOOT \ *

HKLM \ Software \ Microsoft \ Windows NT \ Current Version \ Drivers \ *

HKLM \ Software \ Microsoft \ Windows NT \ Current Version \ Drivers32 \ *

HKLM \ Software \ Microsoft \ Windows NT \ Current Version \ Windows \ AppInit_DLLs

* \ SOFTWARE \ Microsoft \ Windows \ Current Version \ Shell Service Object Delay Load \ *

HKLM \ SOFTWARE \ Microsoft \ VBA \ Monitors \ * \ CLSID

HKCU \ Control Panel \ Desktop \ SCRNSAVE.EXE

* \ SOFTWARE \ Microsoft \ Windows \ Current Version \ Explorer \ Shared Task Scheduler \ *

* \ SOFTWARE \ Microsoft \ Windows \ Current Version \ Explorer \ Shell Execute Hooks \ *

* \ Software \ Policies \ Microsoft \ Windows \ System \ Scripts \ *

* \ Software \ Microsoft \ Windows \ Current Version \ policies \ Explorer \ Run \ *

* \ Software \ Microsoft \ Windows \ Current Version \ Policies \ System \ Shell

HKLM \ Software \ Microsoft \ Windows \ Current Version \ Shell Extensions \ Approved \ *

* \ Software \ Microsoft \ Command Processor \ Auto Run HKLM \ Software \ Microsoft \ Internet Explorer \ Toolbar \ *

* \ Software \ Microsoft \ Internet Explorer \ MenuExt \ *

HKCU \ Software \ Microsoft \ Windows \ Current Version \ Explorer \ File Exts \ .exe \ *

HKCU \ Software \ Microsoft \ Windows \ Current Version \ Explorer \ File Exts \ .com \ *

HKCU \ Software \ Microsoft \ Windows \ Current Version \ Explorer \ File Exts \ .bat \ *

HKCU \ Software \ Microsoft \ Windows \ Current Version \ Explorer \ File Exts \ .pif \ *

* \ SOFTWARE \ Microsoft \ Windows \ Current Version \ Explorer \ Browser Helper Objects \ *

HKLM \ Software \ Microsoft \ Windows \ Current Version \ App Paths \ * \ *

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ Current Version \ Image

File Execution Options \ * \ Debugger

* \ SOFTWARE \ Microsoft \ Internet Explorer \ Extensions \ * \ *

* \ SOFTWARE \ Microsoft \ Internet Explorer \ Extensions \ *

HKLM \ SOFTWARE \ Microsoft \ Code Store Database \ Distribution Units \ * \ Contains \ Files \ *

HKLM \ SOFTWARE \ Microsoft \ Code Store Database \ Distribution Units \ *

Tools 301 and 303 calculate checksums for the following files:

c: \ autoexec.bat

% System Drive% \ autoexec.bat

c: \ config.sys

% System Drive% \ config.sys

Winstart.bat

win.ini

system, ini

*: \ autorun.inf

Also, checksums are generated by means of 301 and 303 for all drivers, .dll and .exe files (or more broadly - for all files listed in the above registry branches).

The following is a typical set of files specific to the Win64 operating system:

The following registry branches are viewed:

- HKCU \ Software \ Microsoft \ Windows \ Current Version \ Run

- HKCU \ Software \ Microsoft \ Windows \ Current Version \ Policies \ Explorer \ Run

- HKLM \ Software \ Microsoft \ Windows \ Current Version \ Run

- HKLM \ Software \ Microsoft \ Windows \ Current Version \ Policies \ Explorer \ Run

- HKLM \ Software \ Wow6432Node \ Microsoft \ Windows \ Current Version \ Run

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Microsoft \ Windows \ Current Version \ Run

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Microsoft \ Windows \ Current Version \ Policies \ Explorer \ Run

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft \ Windows \ Current Version \ Run

Run Once - related branches:

- HKCU \ Software \ Microsoft \ Windows \ Current Version \ Run Once

- HKCU \ Software \ Microsoft \ Windows \ Current Version \ Run Once Ex

- HKLM \ Software \ Microsoft \ Windows \ Current Version \ Run Once

- HKLM \ Software \ Microsoft \ Windows \ Current Version \ Run Once Ex

- HKLM \ Software \ Wow6432Node \ Microsoft \ Windows \ Current Version \ Run Once

- HKLM \ Software \ Wow6432Node \ Microsoft \ Windows \ Current Version \ Run Once Ex

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Microsoft \ Windows \ Current Version \ Run Once

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Microsoft \ Windows \ Current Version \ Run Once Ex

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft \ Windows \ Current Version \ Run Once

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft \ Windows \ Current Version \ Run Once Ex

CLSIDs - related branches:

- HKCU \ Software \ Classes \ CLSID

- HKLM \ Software \ Classes \ CLSID

- HKCU \ Software \ Classes \ Wow6432Node \ CLSID

- HKLM \ Software \ Classes \ Wow6432Node \ CLSID

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ CLSID

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ CLSID

Search - related branches:

- HKCU \ SOFTWARE \ Microsoft \ Internet Explorer \ Search

- HKLM \ SOFTWARE \ Microsoft \ Internet Explorer \ Search

- HKLM \ Software \ Wow6432Node \ Microsoft \ Internet Explorer \ Search

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ Search

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft Mnternet Explorer \ Search

- HKCU \ SOFTWARE \ Microsoft \ Internet Explorer \ Search Url

- HKLM \ SOFTWARE \ Microsoft \ Internet Explorer \ Search Url

- HKLM \ SOFTWARE \ Wow6432Node \ Microsoft \ Internet Explorer \ Search Url

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ Search Url

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ SOFTWARE \ Wow6432Node \ Microsoft Mnternet Explorer \ Search Url

ActiveX load and installation - related branches:

- HKLM \ Software \ Microsoft \ Code Store Database \ Distribution Units HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Microsoft \ Code Store Database \ Distribution Units

- HKLM \ Software \ Wow6432Node \ Microsoft \ Code Store Database \ Distribution Units HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft \ Code Store Database \ Distribution Units Drivers:

- HKLM \ System \ Current Control Set \ Services Context Menu Handlers - - related branches:

- HKCU \ Software \ Classes \ * \ shellex \ Context Menu Handlers

- HKLM \ Software \ Classes \ * \ shellex \ Context Menu Handlers

- HKCU \ Software \ Classes \ Wow6432Node \ * \ shellex \ Context Menu Handlers

- HKLM \ Software \ Classes \ Wow6432Node \ * \ shellex \ Context Menu Handlers

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ * \ shellex \ Context Menu Handlers

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ * \ shellex \ Context Menu Handlers

Browser Helper Object:

- HKCU \ Software \ Microsoft \ Windows \ Current Version \ Explorer \ Browser Helper Objects

- HKLM \ Software \ Microsoft \ Windows \ Current Version \ Explorer \ Browser Helper Objects

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Microsoft \ Windows \ Current Version \ Explorer \ Browser Helper Objects

- HKLM \ Software \ Wow6432Node \ Microsoft \ Windows \ Current Version \ Explorer \ Browser Helper Objects

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft \ Windows \ Current Version \ Explorer \ Browser Helper Objects Shell Execute Hooks:

- HKLM \ Software \ Microsoft \ Windows \ Current Version \ Explorer \ Shell Execute Hooks

- HKLM \ Software \ Wow6432Node \ Microsoft \ Windows \ Current Version \ Explorer \ Shell Execute Hooks

Name Server Protection:

- HKLM \ System \ Current Control Set \ Services \ Tcpip \ Parameters Screen Saver:

- HKCU \ Control Panel \ Desktop Lsp:

- HKLM \ System \ Current Control Set \ Services \ WinSock2 \ Parameters \ Protocol_Catalog 9 \ Catalog_Entries

- HKLM \ System \ Current Control Set \ Services \ WinSock2 \ Parameters \ Name Space_Catalog5 \ Catalog_Entries

Ini File Mapping:

- HKLM \ Software \ Microsoft \ Windows NT \ Current Version \ Ini File Mapping \ system.ini \ boot

- HKLM \ Software \ Microsoft \ Windows NT \ Current Version \ Ini File Mapping \ win.ini

- HKLM \ Software \ Wow6432Node \ Microsoft \ Windows NT \ Current Version \ Ini File Mapping \ system.ini \ boot

- HKLM \ Software \ Wow6432Node \ Microsoft \ Windows NT \ CurrentVersion \ IniFileMapping \ win.ini

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Microsoft \ Windows NT \ Current Version \ Ini File Mapping \ system.ini \ boot

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Microsoft \ Windows NT \ Current Version \ Ini File Mapping \ win.ini

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft \ Windows NT \ Current Version \ Ini File Mapping \ system.ini \ boot

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft \ Windows NT \ Current Version \ Ini File Mapping \ win.ini

IE About:

- HKCU \ SOFTWARE \ Microsoft \ Internet Explorer \ About URLs

- HKLM \ SOFTWARE \ Microsoft \ Internet Explorer \ About URLs

- HKLM \ SOFTWARE \ Wow6432Node \ Microsoft \ Internet Explorer \ About URLs

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ About URLs

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ SOFTWARE \ Wow6432Node \ Microsoft Mnternet Explorer \ About URLs IE Explorer Bars:

- HKCU \ Software \ Microsoft \ Internet Explorer \ Explorer Bars

- HKLM \ Software \ Microsoft \ Internet Explorer \ Explorer Bars

- HKLM \ Software \ Wow6432Node \ Microsoft \ Internet Explorer \ Explorer Bars

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Microsoft \ Internet Explorer \ Explorer Bars

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft \ Internet Explorer \ Explorer Bars Restrict Run:

- HKCU \ Software \ Microsoft \ Windows \ Current Version \ Policies \ Explorer \ Restrict Run Shell Open Command:

- HKCU \ Software \ Classes \ batfile \ shell \ open \ command

- HKCU \ Software \ Classes \ batfile \ shell \ runas \ command

- HKCU \ Software \ Classes \ comfile \ shell \ open \ command

- HKCU \ Software \ Classes \ exefile \ shell \ open \ command

- HKCU \ Software \ Classes \ ftp \ shell \ open \ command

- HKCU \ Software \ Classes \ htafile \ shell \ open \ command

- HKCU \ Software \ Classes \ htmlfile \ shell \ open \ command

- HKCU \ Software \ Classes \ http \ shell \ open \ command

- HKCU \ Software \ Classes \ https \ shell \ open \ command

- HKCU \ Software \ Classes \ mailto \ shell \ open \ command

- HKCU \ Software \ Classes \ mp3file \ shell \ open \ command

- HKCU \ Software \ Classes \ mpegfile \ shell \ open \ command

- HKCU \ Software \ Classes \ piffile \ shell \ open \ command

- HKCU \ Software \ Classes \ txtfile \ shell \ open \ command

- HKCU \ Software \ Classes \ cmdfile \ shell \ open \ command

- HKCU \ Software \ Classes \ regfile \ shell \ open \ command

- HKCU \ Software \ Classes \ scrfile \ shell \ open \ command

- HKCU \ Software \ Classes \ vbsfile \ shell \ open \ command

- HKLM \ Software \ Classes \ batfile \ shell \ open \ command

- HKLM \ Software \ Classes \ batfile \ shell \ runas \ command

- HKLM \ Software \ Classes \ comfile \ shell \ open \ command

- HKLM \ Software \ Classes \ exefile \ shell \ open \ command

- HKLM \ Software \ Classes \ ftp \ shell \ open \ command

- HKLM \ Software \ Classes \ htafile \ shell \ open \ command

- HKLM \ Software \ Classes \ htmlfile \ shell \ open \ command

- HKLM \ Software \ Classes \ http \ shell \ open \ command

- HKLM \ Software \ Classes \ https \ shell \ open \ command

- HKLM \ Software \ Classes \ mailto \ shell \ open \ command

- HKLM \ Software \ Classes \ mp3file \ shell \ open \ command

- HKLM \ Software \ Classes \ mpegfile \ shell \ open \ command

- HKLM \ Software \ Classes \ piffile \ shell \ open \ command

- HKLM \ Software \ Classes \ txtfile \ shell \ open \ command

- HKLM \ Software \ Classes \ cmdfile \ shell \ open \ command

- HKLM \ Software \ Classes \ regfile \ shell \ open \ command

- HKLM \ Software \ Classes \ scrfile \ shell \ open \ command

- HKLM \ Software \ C lasses \ vbsfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ batfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ batfile \ shell \ runas \ command

- HKCU \ Software \ Classes \ Wow6432Node \ comfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ exefile \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ ftp \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ htafile \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ htmlfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ http \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ https \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ mailto \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ mp3file \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ mpegfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ piffile \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ txtfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ cmdfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ regfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ scrfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Wow6432Node \ vbsfile \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ batfile \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ batfile \ shell \ runas \ command

- HKLM \ Software \ Classes \ Wow6432Node \ comfile \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ exefile \ shell \ open \ command

- HKLM \ Software \ C lasses \ Wow6432Node \ ftp \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ htafile \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ htmlfile \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ http \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ https \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ mailto \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ mp3file \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ mpegfile \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ piffile \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ txtfile \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ cmdfile \ shell \ open \ comrnand

- HKLM \ Software \ Classes \ Wow6432Node \ regfile \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ scrfile \ shell \ open \ command

- HKLM \ Software \ Classes \ Wow6432Node \ vbsfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ batfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ batfile \ shell \ runas \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ comfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ exefile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ ftp \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ htafile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ htmlfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ http \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ https \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ mailto \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ mp3file \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ mpegfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ piffile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ txtfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ cmdfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ regfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ scrfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ vbsfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ batfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ batfile \ shell \ runas \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ comfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHlNE \ Software \ Classes \ Wow6432Node \ exefile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ ftp \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ htafile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ htmlfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ http \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHrNE \ Software \ Classes \ Wow6432Node \ https \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ mailto \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ mp3file \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ mpegfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ piffile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ txtfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ cmdfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ regfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ scrfile \ shell \ open \ command

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Classes \ Wow6432Node \ vbsfile \ shell \ open \ command

User Shell Folders:

- HKCU \ Software \ Microsoft \ Windows \ Current Version \ Explorer \ User Shell Folders

- HKLM \ Software \ Microsoft \ Windows \ Current Version \ Explorer \ User Shell Folders

- HKLM \ Software \ Wow6432Node \ Microsoft \ Windows \ Current Version \ Explorer \ User Shell Folders

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Microsoft \ Windows \ Current Version \ Explorer \ User Shell Folders

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft \ Windows \ Current Version \ Explorer \ User Shell Folders

- HKLM \ SOFTWARE \ Wow6432Node \ Microsoft \ Windows \ Current Version \ Explorer \ User Shell Folders

IE Main:

- HKCU \ SOFTWARE \ Microsoft \ Internet Explorer \ Main

- HKLM \ SOFTWARE \ Microsoft \ Internet Explorer \ Main

- HKLM \ Software \ Wow6432Node \ Microsoft \ Internet Explorer \ Main

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ SOFTWARE \ Microsoft \ Internet Explorer \ Main

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft Internet Explorer \ Main

IE Extensions:

- HKCU \ Software \ Microsoft Internet Explorer \ Extensions

- HKLM \ Software \ Microsoft \ Internet Explorer \ Extensions

- HKLM \ Software \ Wow6432Node \ Microsoft \ Internet Explorer \ Extensions

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Microsoft \ Internet Explorer \ Extensions

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft Internet Explorer \ Extensions

IE Plugin:

- HKLM \ SOFTWARE \ Microsoft \ Internet Explorer \ Plugins \ Extension

- HKLM \ SOFTWARE \ Wow6432Node \ Microsoft \ Internet Explorer \ Plugins \ Extension

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ SOFTWARE \ Microsoft Internet Explorer \ Plugins \ Extension

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ SOFTWARE \ Wow6432Node \ Microsoft \ Internet Explorer \ Plugins \ Extension

IE Menu Extension:

- HKCU \ Software \ Microsoft \ Internet Explorer \ MenuExt

IE Toolbar:

- HKCU \ Software \ Microsoft \ Internet Explorer \ Toolbar

- HKLM \ Software \ Microsoft \ Internet Explorer \ Toolbar

- HKLM \ Software \ Wow6432Node \ Microsoft Internet Explorer \ Toolbar

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Microsoft \ Internet Explorer \ Toolbar

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft Internet Explorer \ Toolbar

IE Shell Browser:

- HKCU \ Software \ Microsoft \ Internet Explorer \ Toolbar \ Shell Browser

IE Uri Search Hooks:

- HKCU \ Software \ Microsoft \ Internet Explorer \ Url Search Hooks

- HKLM \ Software \ Microsoft \ Internet Explorer \ Url Search Hooks

- HKLM \ Software \ Wow6432Node \ Microsoft \ Internet Explorer \ Url Search Hooks

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Microsoft \ Internet Explorer \ Url Search Hooks

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft Internet Explorer \ Url

Search hooks

IE Web Browser:

- HKCU \ Software \ Microsoft \ Internet Explorer \ Toolbar \ Web Browser Safe Boot:

- HKLM \ System \ Current Control Set \ Control \ Safe Boot \ Minimal

- HKLM \ System \ Current Control Set \ Control \ Safe Boot \ Network

Autorun:

- HKCU \ Software \ Microsoft \ Command Processor

- HKLM \ Software \ Microsoft \ Command Processor

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Microsoft \ Command Processor

- HKLM \ Software \ Wow6432Node \ Microsoft \ Command Processor

- HKCU \ Software \ Classes \ Virtual Store \ MACHINE \ Software \ Wow6432Node \ Microsoft \ Command Processor

Checksums are calculated for the following files:

% SystemRoot% \ System32 \ drivers \ *. Sys

% SYSTEMROOT% \ System32 \ Tasks (Task Scheduler)

% ProgramData% \ Microsoft \ Windows \ Start Menu \ Programs \ Startup

% USERPROFILE% \ AppData \ Roaming \ Microsoft \ Windows \ Start

Menu \ Programs \ Startup

(Startup Folder)

C: \ autoexec.bat

% SystemDrive% \ autoexec.bat

c: \ config.sys

% SystemDrive% \ config.sys

Winstart.bat

win.ini

system.ini

*: \ autorun.inf

Also, checksums are generated for all drivers, .dll and .exe files (or more broadly - for all files listed in the above registry branches).

Having the preferred embodiments described above, it will be apparent to those skilled in the art that the specific advantages of the described method and apparatus will be achieved. It should also be borne in mind that various modifications, adaptations, and alternative embodiments can be made within the scope and essence of the present utility model. In addition, a utility model is defined by the following formula.

Claims (6)

1. A system for detecting a rootkit on a computer, which contains: means for creating the first image for the selected operating system and registry files, while this tool is configured to create the first image after loading the boot drivers, but before loading all the other drivers; means for permanently storing the first image obtained by said means for creating the first image; means for creating a second image for the selected files of the operating system and registry, which is created after loading all the remaining drivers; means for comparing the first image obtained from said permanent storage means and the second image obtained from the means for creating the second image; means for issuing a message to the user about a rootkit infection of the computer according to the comparison results received from the said means of comparison, while the means for issuing a message is configured to issue this message in case of inequality of the first and second images. 2. The system according to claim 1, in which the selected files also include system services. 3. The system of claim 1, wherein the operating system is WINDOWS. 4. The system according to claim 3, in which the WINDOWS operating system can be either 32 or 64-bit. 5. The system according to claim 1, wherein said means for creating the first image is configured to create the first image after detecting the SERVICE-BOOT-START flag. 6. The system according to claim 1, wherein said means for creating the first image and said means for creating the second image are configured to create the first and second images, respectively, using the HKLM / SYSTEM / Current Control Set / Control / Session Manager / Boot Execute key .