Vinzenz Feenstra’s WebLog

Hi all there,

after a long silent period without any news I am proud to announce the new version of the AVG Anti-Spyware 7.5.1.36

Here a short overview about the changes in the new release:

- Windows Vista support
- Support for 64-Bit editions of Windows (Windows XP 64-bit & Windows Vista 64-Bit)
- Better reliability + speed of updates
- Higher priority for paying users on update servers
- Fixes for many bugs (including high CPU usage + scheduler bugs)

The problem with the slow/unreliable updates will not be fixed at once, it will take some time until the vast majority of the user base has switched to the new version.

The new version will also be released via online-update in the next days. You can either wait for the update or manually download it from:

http://downloads.grisoft.cz/softw/70/filedir/inst/avgas-setup-7.5.1.36.exe

In any case, a system reboot is required.

Regards,

Vinzenz Feenstra

Tags: Anti-Rootkit, Rootkits, Threats, Malware, Removal, Anti-Spyware, Download, Screenshot, Images, Security, Windows, Microsoft, AVG, Grisoft

I have previous posted about the Windows threat ‘Trojan.downloader.uj’ and that I have build a removal help tool for it.

I think it would be best for all if I post here some removal steps for this special threat which is really tricky, since it is a trojan but uses userland rootkit techniques.

Here are the steps:

1. Download the file "rmdlagentuj.exe" from following location: http://fileserver.ewido.net/public.cgi?id=20845
2. Execute the file "rmdlagentuj.exe" if it was successful you will get a message dialog where you will be asked to reboot
3. Reboot your computer (Important!)
4. Execute a complete system scan with ewido anti-spyware 4.0 ( http://www.ewido.net )

Or you can try Grisoft AVG Anti-Rootkit Beta 1.0.0.13, but be careful it is a beta!
Thats’s all the threat should be removed now.

Aliases for this threat are:

I hope this is helpful.

Regards,

Vinzenz Feenstra

Tags: Removal, Steps, Security, Windows, Userland, Rootkit, Rootkits, Tutorial

I was reading  blog entry of Joanna Rutkowska, a really smart and good looking (*fg*) expert in security and rootkits from Poland, and I was really asking myself, should we be scared about rootkits in the future? To give you a short answer: Yes we should!

Ok of course such rootkit can maybe be blocked before they’re installed or while it tries to installs itself or any other malware tries to install it. I am reading about the technology and the evolution of the knowledge in this area for a while and I need to say that it is really scary how fast the evolution moves forward.

Last year I was reading something about DKOM (Direct Kernel Object Manipulation), after thinking about the concept I was sure something like this is comparative easy to detect. Also hooking SSDT, IAT, EAT or using Inline Hooks (Detours) is almost harmless if you know how to get rid of it (see my previous post Trojan.Downloader.uj which is about an userland rootkit)

Anyway this year, only about 6 months later I read something which really scared me. joanna Rutkowska held some presentations about rootkits again and there she demonstrated a rootkit she is calling ‘deepdoor’. After taking a look at what she can do with this threat I was really asking myself how should you detect something like this. Ok there will be some smart guy who will be abled to detect (I am sure there will be one!). But now (ok it was already in June, but it doesn’t matter) she is writing about ‘Blue Pill’. Think about this: You are running VMWare on your computer and host another windows in there. This no great deal, that’s right but what would you say if somebody tells you that you’re hosting VMWare already in a virtual environment?

Huh? That’s really scary. And I must admit that using the name ‘Blue Pill’ is a really good choosen name.

I am right in the beginning in understanding how malware works and how it can be detected and removed but if I read something like this I am really asking myself how should we prevent ourselves from such threats?

I hope that we will be abled to have an idea how to get a ‘Red Pill’ for such threats and are abled to remove or at least to warn the users about such a threat.

Further reading about this subject you can find at:

• http://invisiblethings.org/papers.html - Rootkit Hunting vs. Compromise Detection (AKA Rootkits vs. Stealth by Design Malware) - January 2006
• http://theinvisiblethings.blogspot.com/ - There you will find the blog entry about ‘Blue Pill’
• And an article in eWeek

Edit: (8th August 2006) I found another really interesting blog entry about this at http://www.ryanpmanning.com/?p=56

Be aware! Be scared!
Regards,
Vinzenz Feenstra

Tags: Rootkits, Malware, Security, Microsoft, AMD, Windows, Detection

Grisoft AVG Anti-Rootkit 1.0.0.13 Beta released

I am proud to announce that Grisoft has released the AVG Anti-Rookit Beta available at http://beta.grisoft.cz after a registration (which is for free)

I really  warn everyone this is a  beta software it may work but you should be careful!

While scanning:

After a scan:

Please report your test results and your opinion about it.

Regards,

Vinzenz

Tags: Security, rootkit, anti-rootkit, anti-malware, anti-spyware, rootkits, trojans,

Hi,

A long time we couldn’t help users to get rid of the "Userland Rootkit" Downloader.Agent.uj.

Today I wrote an utility to help users getting rid of this damn threat. If someone has a problem with removing a threat please feel free contact our support forums
at wilders[1] and we’ll assist you to remove this threat.

[1] ewido anti-spyware Support Forums at Wilders

Regards,

Vinzenz

Tags: Rootkit, ewido, Anti-Spyware, Anti-Malware, Removal, Tool, Forum, Support,

Hey guys,

First of all I must admit that this is not really a brand new news but ewido anti-spyware 4.0 is somehow my baby although I don’t have developed it from the beginning and I don’t have developed everything, but an huge amount of it.

So I’d like to talk about ewido anti-spyware 4.0 a little bit

Back in July 2005 I have started working as freelancer for ewido networks, the company who has started developing the ewido security suite several years ago. My first job was to implement an autostart analysis module for this version 4.0 and at this time ewido 4 has still the old graphical user interface style. About one month after starting working at ewido networks I was asked to become an employee, that was an overwhelming majority offer for me since I am just a self-educated person who has made an apprenticeship as cook, and becoming an employee as software developer was always my dream. One month later, on September 1st 2005, I was the first official employee of ewido networks and I walked on air From this time I have implemented a lot of features, and overhauled almost every code line already exist.

Now back to ewido anti-spyware 4.0 ewido anti-spyware 4.0 was released on the 19th June 2006 and has the following new features:

• Scheduled scans
• A BHO (Browser Help Objects) analysis module
• A LSP (Layered Service Provider) analysis module
• A Fileshredding module with 3 different shredding modes
• An improved and brand new User Interface
• Built in language selection
• Customizable update periods
• An internal reportviewer
• Automatic report generation options
• A new scan results view, you’re no longer irritated from popups while the scan is in progress
• An Antispy settings module
• Improved resource usage
• Translated and highly detailed and easily understandable help files
• An exception list to ignore possible false positives
• Customizable scan profiles which can be scheduled, too
• More details in the processviewer
• More details in the network connections viewer (unfortunately only in Windows XP, Windows 2000 does not support everything we’d like to show, but we’re still looking for a solution for this, because we know there is one)

Vinzenz