Windows Live Messenger Rootkit? 1

[KimberTech]

I had posted this in the spyware thread and was advised someone here might be able to help.

While beta testing the new messenger software I had a shared folder with a relative newbie.
A "friend" of theirs subsequently did a spyware sweep and found potential rootkit warnings that all pointed back to the messenger program.

I recall seeing some documentation about false positives, and that Microsoft had acknowledged it, but can't find it now.

I would like to provide the information to the person to defend myself, and my qualifications. There was no infection, I made sure.

I have googled this to death and found some notice board/blog type entries, but nothing from an official source.

Any help MOST appreciated.

Kimber

 

[bcastner]

Do you happen to know what software, and what release of that software, was used to discover this rootkit?

 

[KimberTech]

I have requested this information but don't have it yet.

I suspect it is Spysweeper, just a hunch.

Thank you for your response.

K

 

[bcastner]

Run these three:

http://www.f-secure.com/blacklight/

http://www.sysinternals.com/Utilities/RootkitRevealer.html

http://www.microsoft.com/security/malwareremove/default.mspx

If they all agree you are clean of rootkits, you are clean.

 

[bcastner]

Also, if the three programs above show clean, have them repair their Spy Sweeper:

Open Spy Sweeper, click the Home button, then hold down the Ctrl and Alt keys on your keyboard while double-clicking the Spy Sweeper icon.

Doing so will bring up a small menu of additional support buttons. One of these buttons is labeled Download Full definitions. Click this button and let the definitions fully download.

 

[KimberTech]

Will do, and will update on results.
I was positive I saw some documentation showing false positives on Live Messenger....will post that too if I find it.

K

 

[linney]

Can't help you much with any Microsoft documentation but I thought you would like this piece of detective work.

New Rootkit? Hides any file named log.dll

http://forum.sysinternals.com/forum_posts.asp?TID=2623&KW=windows+live+messenger

RootkitRevealer Usage Forum

http://forum.sysinternals.com/forum_topics.asp?FID=15&PN=0

 

[Glenn9999]

I looked around a little bit and do notice that people are pairing rootkit tech with their AIM worms. I wouldn't be surprised if a similar thing has been done with an MSN worm of some kind.

More reading for you:

http://www.informationweek.com/story/showArticle.jhtml?articleID=175007154&cid=RSSfeed_IWK_Windows

 

[KimberTech]

You guys are the best. Thanks for being there..will update when I finalize this.

K

 

[KimberTech]

Rootrevealer was the only one that found anything at all.
Both of the others say I am clean.

The results showed entries only for MSN messenger and then only for the three users with which I had shared folders.

How do I interpret the data to explore this further?

I am reading but time is of the essence so any help much appreciated.

K

 

[linney]

Save the Rootkit Revealer file output and post a copy of it here if it is not too big. Somebody might be able to throw some light on the matter. Don't forget about the Rootkit Revealer forum linked to earlier.

What does Rootkit Revealer say if you disable the shared folder option in Messenger before you run it?

 

[bcastner]

. What appeared in the Description column?
. What was the filename and path(pick one)

See:

http://www.sysinternals.com/Utilities/RootkitRevealer.html

 

[bcastner]

Here's your "Rootkit", it is a false positive:

http://blogs.virtualserver.tv/blogs/dugie/archive/2006/01/31/Windows_Live_Messenger_uses_DFSR.aspx

http://www.neowin.net/forum/index.p...pic=475324&pid=587663239&st=0&#entry587663239

http://forums.invisionpower.com/lofiversion/index.php/t206405.html

 

[bcastner]

You can use this Microsoft Utility to cleanup:

http://www.microsoft.com/downloads/...d3-4c94-47e1-826f-1b889f576698&DisplayLang=en

 

[KimberTech]

Thanks for the help, suggestions and links. I WILL update as promised. I am in the process of documenting and cleaning up.

K