3
1
I was at work and got a help desk call about a rather severe malware infection and it got me thinking about my own computer.
I am running Windows 7 64-bit RC1 on my everyday laptop. I run ESET NOD32 antivirus which does a good job of keeping itself up to date. I never turned off UAC.
I am also a computer professional so I have a pretty good idea when NOT to click OK on a windows dialog that looks rogue.
All that to say that I think I am clean but I wanted to be sure so I booted into safe-mode and downloaded and did a quick scan using the well-recommended anti-malware tool MalwareBytes tool. It only found a strange registry entry which I deleted. No file or folder problems were detected. I rebooted to complete the clean as it requested. I was surprised by this because all it did was clean a registry entry.
Oh yeah...one other thing run the professional edition of BillP Studio of WinPatrol.
After re-booting normally, WinPatrol warned about new program MalwareBytes which I expected and allowed. But to my surprise it also had me confirm the install/setup of userinit (I can't remember if it was dll or exe) but the program info was that this is the file that presents the startup screen to windows. I allowed it but it caught me off guard.
One last thing. I tried to also run root-kit revealer and IceSword so I could do a rootkit scan on my machine and neither of them would run and I am pretty sure it is because I am running a 64-bit OS.
So here are my questions:
Is it normal for userinit to be "re-installed" or "re-init" after doing a scan using MalwareBytes? If not, why was a prompted for allow permissions for that file?
Is there a known/recommended way to do a rootkit scan of 64-bit windows system?
Is it possible that my machine is LESS likely to have a rootkit problem BECAUSE I am running as 64-bit OS. Wouldn't a rootkit have to run as a 64-bit process and isn't it likely that right now that rootkits will not be written to target 64-bit since it is a smaller target audience? Is my risk surface-area actually less?
Thanks in advance.
Seth
Idk about the rest, but concerning #3: No. Windows 64-bit supports running 32-bit processes if you haven't noticed yet. – Will Eddins – 2009-10-01T17:20:36.910
I'm interested in hearing more about the so called new security that windows 7 is claiming to have. Anyone have any hard information on this? All I've heard of so far is that it's better, and that windows defender now covers viruses as well. – Sakamoto Kazuma – 2009-10-01T17:39:08.557
Guard,
It is true you can run 32-bit programs. But you CAN'T run 32-bit drivers. 64-bit requires 64-bit drivers. And the point of the question is I would THINK -- but can't be sure, which is why I ask-- that a rootkit would need driver level support/permissions rather than mere application level support/permissions. – Seth Spearman – 2009-10-01T19:18:29.870
It's a good point Seth. A kernel rootkit will indeed need a driver. Furthermore, being bent on replacing certain parts of the kernel, it will need to be designed with 64-bit versions in mind, or crash under Win 64-bit. However it also needs to be said, there are other types of rootkits (http://en.wikipedia.org/wiki/Rootkit#Types) for which a device driver is not needed. And... not all device drivers need to be specifically designed for 64-bit OSes.
– A Dwarf – 2009-10-01T20:36:55.530