About Rootkit Unhooker

Rootkit Unhooker/RkU

Copyright © 2006 - 2007 DNY, EP_X0FF, MP_ART

www.rku.xell.ru

Rootkit Unhooker (RkU) is an advanced rootkit detection/removal utility. It runs under 32bit Windows 2000, Windows XP, Windows 2003 Server. Windows NT4.0 and Windows Vista are not supported.

  • Main features

  • Users manual

  • Frequency Asked Questions

  • Reporting bugs and feedback

  • Console Mode

  • Version Information

  • Copyright information

Any bugs reports/suggestions/critics are welcome

FAQ section is frequency updates, so if you have any questions please look in the FAQ first.

To avoid possible problems, please do not start any other rootkit detectors while RkU is running.

Warning: Rootkit Unhooker is INCOMPATIBLE with GMER antirootkit tool. Do not start them together.

RKU/RkU/RKUnhooker/RKUnHooker/RootkitUnhooker/RootKit Unhooker/Rootkit UnHooker names are the same.

RkU was passed all tests on these Windows versions:

Windows 2000 Professional SP4

Windows XP Professional SP1

Windows XP Home/Professional SP2

Windows 2003 Server Enterprise Edition,

Windows 2003 Server Standard Edition SP1

It does not mean that RkU cant work on other Windows version, it is mean that correct work of program is not guaranteed.

Warning: You use this program on your risk. This program is distributed in hope that it will be useful, but WITHOUT ANY WARRANTY.

Help © 2006 - 2007, UG North DNY & EP_X0FF


Main Features

Service Descriptor Table hooks detection

Includes Service Descriptor Table hooks removing (unhooking)

SYSENTER/Int 2e hooks detection

Detection of hooking sysenter instruction handler and system interrupt (IDT) hook

SYSENTER/Int 2e hooks removing (unhooking)

Restoring original instruction (interrupt) handler

Hidden processes detection

Detection of processes hidden from Windows API

Most powerful in the world at current time

Detection of processes with full path and name (unique)

Hidden processes terminating

Including force-kill powered by PVASE

(c) PVASE Process Virtual Address Space Erasing

Hidden processes dumping

With ability to rebuild file for analysis

Hidden drivers detection

Detection of drivers hidden from Windows API

combines four different methods of detection and including special five (c) Stealth Walker technology

and six (c) KMSE - Kernel Memory Scanning Engine

Hidden drivers dumping

Unique feature that gives you ability to make dump of selected driver

IRP hooks detection

Look for "References" column on the Hidden Drivers Detector page

Detection of API-based hooks (Code Hooks Detection)

Includes most powerful at this time inline (splicing) hooks detection in drivers and libraries. Detected hooks: functions based hooks, IRP based hooks (for drivers), IDT hooks. Also includes first in the world public kernel mode IAT hooks detection engine.

Detection of hidden libraries

As part of Code Hooks Detector page. Displays address (if can be determined) of hidden library

Hidden files detection

Includes detection of files hidden from Windows API on the disks. Supported file systems are: FAT32 and NTFS (full support - including ADS).

Low level files operation

Wipe/Copy functions for hidden and visible files (including ADS).

Update system

Can check our server for program updates

Report generation

Automatically generates report with all needed information (not huge and useless like in others programs)

Program self-protection

Contains some methods that are able to prevent some malware from interrupting work of program. Includes internal integrity checking and antidebugging

To use RkU in Windows Safe Mode check Setup->"Extended Mode"

RkU requires Administrator privileges to run and work

RkU incompatible with some kernel mode debuggers

RkU incompatible with GMER antirootkit tool

About changes please refer to Version History


Users manual

§ Pages overview

Main program window contains six pages:

  1. SSDT Hooks Detector/Restorer

  2. Hidden Processes Detector

  3. Hidden Drivers Detector

  4. Hidden Files Detector

  5. Code Hooks Detector

  6. Report

Here description of each of them.

SSDT Hooks Detector/Restorer

To speak user friendly - System Service Descriptor Table is an place where system stores pointers on the main system functions. Some kernel mode rootkits usually using the following technic - replace actual address of function in this table on address of their own handler-function. Some commercial software also uses this technic, for example Panda Antivirus hooks NtTerminateProcess function to prevent terminating of antivirus executables. Agnitum Outpost uses the same and additionally hooks NtWriteVirtualMemory to protect users from malware technics known as code injection. Alcohol\Daemon Tools CD emulation software hooks registry-related functions to defeat DRM.

RkU can show you actual state of SSDT, show which functions (they also called services in MS terminology) are hooked and unhook them. When RkU makes unhook its replace hooked addresses with original.

Hidden Processes Detector

Main purpose of rootkits - hide itself from user. Some of rootkits hides its executables from API, so standard processes monitoring tools like Task Manager, Process Explorer can't see them. RkU uses ultimate processes detection engine that shows you everything.

Hidden Drivers Detector

Rootkits also hides their own drivers to prevent user from removing them. RkU powered by special core that can detect hidden drivers.

Hidden Files Detector

Rootkits hiding their own binary files, text logs from Standard Windows API. RkU powered by special code that can detect hidden files and copy/delete them.

Code Hooks Detector

Another tactic of rootkit malware - hide their presence by hooking Windows API system management functions. RkU can detect that type of hiding by comparing actual image and code integrity with given by operation system. Additionally RkU also check main OS components (such as disk/network drivers). RkU also can restore original code by overwriting existing one.

Warning: in some cases this can lead to BSOD and PC reboot.

Types of detected hooks:

Inline - presents in Kernel and User Mode. Intruder application or driver writes their own code in function body making redirect to their handler. This type of hooks also can be applied to drivers with no exporting functions, this is so called IRP inline hooking.

Detection difficulty - various, from medium to very hard

IAT - presents in Kernel and User Mode. Intruder application or driver replaces functions addresses with it's own by patching Import Table. That type of hooks used almost only in User Mode.

Detection difficulty - various, from very easy to easy

Syscall - System Call (also so called call gate) special instruction (or interrupt) used by operation system to transfer user mode calls to kernel mode. Intruder replaces actual address of handler with their own. Can be combined with Inline type of hooking.

Detection difficulty - various, from very easy to medium

Report

When you are asking for help it is very useful to get report of your system state. This page gives you that possibility.

§ System Call Hooks Detection/Restoring

Special ability of RkU is detection and restoring of so called System Call instruction. RkU System Call Detection/Restoring features located on Code Hooks Detector page.


Frequency Asked Questions

Q: Some files are blocked for access on my disk, I think they related to malware. What can I do? How RkU can help me?

A: If files are visible then use Wipe/Copy File feature (Main Menu->Tools->Wipe / Copy File).

Wipe - wiping file content (it will be filled with zeroes)

Copy - copying file content to other file by your wish

If files are invisible then use Hidden Files Detector + Wipe/Copy feature (the same functionality as described above)

Q: RkU shows that whole SSDT are hooked by ntoskrnl.exe + klif.sys. What is it?

A: Kaspersky Antivirus normal behaviour. False positive. Do not unhook any SSDT functions -> that will lead to BSOD.

Q: What wrong with System Safety Monitor? Why your program can't some times works with it together?

A: SSM using malware-like thread injection technology. Execution with SSM in the same time can lead to BSOD.

Q: What's means "Dump all process memory"?

A: Unlike simple process dump function that feature gives you ability to save ALL virtual memory of selected process. It is can be useful for further process analysis.

Q: What is a difference between process "Kill", "Force Kill", "Force Kill + File Erase" feature?

A: First uses standard technic to ends process life, second erases all process virtual memory (that makes process totally unworkable), third the same as second + physically removing file from the disk.

Q: When I starts program it is shows "Rootkit Unhooker has detected parasite inside itself!". What is it?

A: Some malware using special intrusion technic to bypass detection. RkU has detected one of them.

Q: Rootkits - malware?

A: No, in first it is useful kits, but used almost only by malware.

Q: Can this program detects Inline User & Kernel Mode hooks?

A: RkU detects hooks on main OS libraries in User Mode and OS Core file and drivers in Kernel Mode.

Q: Will RkU works in Safe Mode?

A: Yes, if you check Setup->"Extended mode". RkU driver (rkhdrv10.sys) will be configured to start during Windows boot period.

Q: Why I do not see name of the rootkit process/driver?

A: Because authors of this shit erased all meaningful information about it.

Q: Can RkU detect hidden files?

A: It can. Go to Hidden Files Detector.

Q: Can RkU remove rootkit from system?

A: No, RkU program only "uncover"/destroys rootkits. Next step is remove rootkit dead bodies with AV/yourself.

Q: When I press "UnHook ALL" its gives me BSOD (blue screen of dead) what I'm doing wrong?

A: You should try to unhook only these services that hides files/registry entries (e.g. NtEnumerateKey).

Q: It is possible for rootkit to hide itself from RkU?

A: Everything is possible. Rootkits writers should use for this specific code. But most of the rootkits are "proof-of-concept", so they should be displayed.

Q: What additional programs should I use to detect/fight with rootkit(s)?

A: RootkitRevealer from www.sysinternals.com, DarkSpy, IceSword. All others - full shit.

Q: What is a rootkit?

A: Visit www.rootkit.com

Q: Is RkU malware? My "super antivirus" reports that it is crypted... :(

A: No, damn it! It is NOT malware ><

Q: RkU shows that my AV/Firewall drivers hooks some functions. It is normal?

A: Yes. There are many companies using rootkits technologies in their own products.

Q: I want to get sources! For example to create command line mod.

A: Sources are no more available.

Q: Can I disassemble/reverse this?

A: No, but you can try.

Q: EP_XOFF?

A: No, damn it! He is EP_X0FF.


Reporting Bugs and Feedback

Please try to supply enough information so that we can reproduce the problem. Send bug reports to rkunhooker@xell.ru

Note: We are not offering any consultations about programming and malware researching and not answering on such questions. Use this email only for reporting bugs and feedback. Any other email's will be deleted.


Console Mode

Designed to configure RkU before start.

Starting console

To start Rootkit Unhooker in console mode type open Windows console, type RkU program name and add "-console"

(without "") to the end.

For example 4DB28FF328.exe -console

Console commands

Currently available only 5 commands:

help

Displays list of commands with small description of each of them

start

Close console and continue load Rootkit Unhooker

exit

Close console and quit Rootkit Unhooker

forcesafemode

Configure Rootkit Unhooker driver to be started in Windows Safe Mode. This is useful for example if RkU was not configured to start in Windows Safe Mode and Windows can't normally boot.

check

Forces RkU made integrity check for parasites inside it.

A lot of others commands will be available in next releases.


Version History

version 3.01 build 100/360 (18.01.2007)

added: full Unicode support

added: pages selection for Report page

added: disks selection for Hidden Files Detector page

added: global settings dialog

added three modes for SSDT Detector/Restorer page

  1. normal - everything displaying as always

  2. simple - show hooks only if their addresses are outside kernel module (useful for KAV users)

  3. show only hooks

note: b mode can be combined with c mode.

fixed: few bugs in application and driver

updated: ILHA v2.0

  1. inline hooks detection was improved (for libraries and for drivers)

  2. inline IRP hooks detection also was improved

  3. added IAT hooks detection/restoring under User / Kernel Mode

  4. added IDT hooks detection

updated: xdf v0.6: all detected and reported security flaws are closed

version 3.00 build 88/344 RC4 (20.12.2006)

improved: overall speed of all scanning engines

fixed: some bugs in ILHA hooks detection engine

further internal optimisation

VM detection moved as separate function in "Tools" menu

updated: program help file


Copyrights Information

Copyrights

Copyright © 2006 - 2007 DNY, EP_X0FF, MP_ART

Version 3.01 code named "SplicerEx"

The most political rkdetector in the world

Authors:

from UG North

DNY and EP_X0FF (EvilPhantasy_x0FF)

from HL

MP_ART

Program Components:

Main Engine v3.01

SSDT Hooks/Restore v1.1

Stealth Engine, v1.7 Hidden processes detector

DnG v1.4 Hidden drivers detector

FDetector v1.0263 Hidden files detector

ILHA v2.0560 Code hooks analyzer

C_Me v0.1 Console

UpS v1.0 Update system

xdf v0.6 Guess what?

Program Information:

Driver is written on C, using MSVC 2005

Application is written on Pascal, Delphi 5 Enterprise

Greetings:

To former members of UG, TnG groups

We would like to say special "thank you" to the following peoples and orgs.

DNY, Ms-Rem, Four-F, PE386, j0ker, Z0mBie, SpannerItWks, Mixel, fcukdat, saso, Bruno Eduardo.

For our unofficial beta testers, wasm.ru, xell.ru, antirootkit.com, VX heavens

Sorry, if we forgot somebody :)