F-Secure reported Mailbot family that use hidden streams to hide themselves.
Let’s take Mailbot.AZ(aka Rustock.A) as an example.
Mailbot.AZ is a kernel-mode rootkit that modifies the kernel to hide its presence on the compromised system. It contains an encrypted payload that will be executed in the context of a process named “services.exe”. The payload is a Spamtool with backdoor capabilities.
There’s only a single component lying on the disk, and that is a kernel-mode driver. It’s stored as hidden data stream attached to the system32 folder (yes, folders can have data streams as well)! Saving your data into Alternate Data Streams is usually enough to hide from many tools. However, in this case, the stream is further hidden using rootkit techniques, which makes detection and removal quite challenging. Because Mailbot.AZ is hiding something that’s not readily visible, it’s very likely that many security products will have a tough time dealing with this one.
F-Secure have just released a new version of our BlackLight rootkit scanner (Build 2.2.1041) that can detect current variants of Mailbot.
To remove the infection, perform the following steps:
- Reboot your system using the Windows Recovery Console (using your Windows installation CD – click on the hyperlink for details).
- Copy a non-executable file from the Windows directory over the Alternate Data Stream.
For example, run the following command:
- copy c:\windows\win.ini c:\windows\system32:18467
Please note that the copy command will fail but the malicious file has actually been truncated to zero-length.
