Rootkit binaries can often be detected by signature or heuristics-based antivirus programs, at least until they're run by a user and are able to attempt to conceal themselves. There are inherent limitations for any program that attempts to detect rootkits while the program is running under the suspect system. Rootkits are suites of programs that modify many of the core system tools and libraries upon which all programs on the system depend. Some rootkits attempt to modify the running
operating system via loadable modules on Linux (and some other UNIX varieties), and through
VxDs, virtual external
device drivers on MS Windows platforms. The fundamental problem with rootkit detection is that if the operating system currently running has been subverted, it cannot be trusted, including to find unauthorized modifications to itself or its components. In other words, actions such as requesting a list of all running processes, or a list of all files in a directory, cannot be trusted to behave as intended by the original designers. Rootkit detectors running on live systems currently only work, because the rootkits they can detect have not yet been developed to hide themselves fully against these detectors. A reasonable analogy would be asking a brainwashed person if they had been brainwashed; obviously their answer could not be trusted.
The best, and most reliable, method for operating system-level rootkit detection is to shut down the computer suspected of infection, and then to check its
storage by
booting from an alternative trusted medium (e.g. a rescue
CD-ROM or
USB flash drive)[
citation needed]. A non-running rootkit cannot actively hide its presence, and most established antivirus programs will identify rootkits armed via standard OS calls (which are often tampered with by the rootkit) and lower level queries, which ought to remain reliable. If there is a difference, the presence of a rootkit infection should be assumed. Running rootkits attempt to protect themselves by monitoring running processes and suspending their activity until the scanning has finished; this is more difficult if the rootkit is not allowed to run.[
citation needed]
Security software vendors have attempted a solution by integrating rootkit detection into traditional antivirus products. Should a rootkit decide to hide during scanning, it will be identified by the stealth detector. If it decides to temporarily unload from the system, the traditional antivirus will find it using fingerprint detection. Since anti-virus products are almost never entirely capable of catching all viruses in public tests, this approach may be doubted on past behavior. But this combined approach may force attackers to implement counter-attack mechanisms (so called retro routines) in their rootkit code that will forcibly remove security software processes from memory, effectively killing the antivirus program. As with
computer viruses, the detection and elimination of rootkits will be an ongoing struggle between tool creators on both sides of this conflict.
There are several programs available to detect rootkits. On Unix-based systems, three of the most popular are
chkrootkit,
rkhunter and
OSSEC. For Windows, there are many free detection tools such as
avast! antivirus,
Sophos Anti-Rootkit,
F-Secure Blacklight, and
Radix. Another Windows detector is
RootkitRevealer from
Microsoft (formerly
Sysinternals) which detects rootkits by comparing results from the
OS against expected results obtained by bypassing the operating system and analysing the raw underlying structures in the
file system (
cross-checking). However, some rootkits started to add RootkitRevealer to a list of files it does not hide from, so in essence, they remove differences between the two listings, and the detector doesn't report them (most notably the commercial rootkit
Hacker Defender Antidetection). Rootkit Revealer has apparently fixed this problem as they stated on their official page: "The reason that there is no longer a command-line version is that malware authors have started targeting RootkitRevealer's scan by using its executable name. We've therefore updated RootkitRevealer to execute its scan from a randomly named copy of itself that runs as a Windows service. This type of execution is not conducive to a command-line interface. Note that you can use command-line options to execute an automatic scan with results logged to a file, which is the equivalent of the command-line version's behavior."
[18]
Another method is to compare content of binaries present on disk with their copies in operating memory — however some valid differences can be introduced by operating system mechanisms,
e.g., memory relocation or
shimming, but some can be very likely classified as system call hooks introduced by a running rootkit (
System Virginity Verifier).
Zeppoo is another software product which detects rootkits under
Linux and
UNIX systems.
As always, prevention is better than cure, for being certain you have removed a rootkit typically involves re-installation of all software. If the integrity of the system install disks is trusted, cryptography can be used to monitor the integrity of the system. By "fingerprinting" the system files immediately after a fresh system install and then again after any subsequent changes made to the system,
e.g., installing new software, the user or administrator will be alerted to any dangerous changes to the system's files. In the fingerprinting process a
message digest is used to create a fixed-length "digest" dependent on every bit in the file being fingerprinted. By calculating and comparing message digest values of files at regular intervals, changes in the system can be detected.
Detection in
firmware can be achieved by computing a
cryptographic hash of firmware and comparing hash values to a whitelist of expected values, or by extending the hash value into TPM (
Trusted Platform Module) configuration registers, which are later compared to a whitelist of expected values. Code that performs hash, compare, and/or extend operations must itself not be compromised by the rootkit. The notion of an immutable (by a rootkit) root-of-trust, if implementable, ensures that the rootkit does not compromise the system at its most fundamental layer. A method of rootkit detection using a TPM is described by the
Trusted Computing Group.
[19]