How to identify software causing SSDT Hooks

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by mosem, Oct 7, 2009.

  1. mosem

    mosem Private E-2

    Is there any way of identifying the software (dll's, exe's etc..) responsible for the SSDT Hooks into the Windows XP (SP3) kernel (ntkrnlpa.exe)?

    IceSword and RootRepeal and others report I have 11 Hooks, and I would like to know the names of the files and software that is hooking them, even if they are not malicious. I have Avira AntiVir Premium installed, it may be that, but the other day I removed a Dropper trojan with MalwareBytes.

    A lot of programs just report the hooking modules as UNKNOWN, but I want to know what the Hooking software is.

    Thanks
    :confused
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    SSDT hooks can be valid or they can be used by malware. Right now I have 11 on my own system. One from SUPERAntiSpyware and 10 that are called unknown but that are just system related. You have to be careful not to over react to what you see in scanner outputs. Often times what is being shown are not problems.

    If you really want to investigate them in detail, check out the below:

    http://diamondcs.com.au/dse/detection/shadowtable-hook.php

    http://www.avertlabs.com/research/blog/index.php/2007/05/04/a-new-rootkid-on-the-block/

    http://www.rohitab.com/discuss/index.php?showtopic=24567

    http://vrt-sourcefire.blogspot.com/2008/11/fun-with-ssdt-hooks-and-dep.html

    Also have you checked out this: http://www.antirootkit.com/software/RootKit-Unhooker.htm
     
    Last edited: Oct 10, 2009
  3. mosem

    mosem Private E-2

    I installed DiamondCS ProcessGuard (a good product) 3 days ago and it blocked 6 of the 11 Win XP Kernel SSDT Hooks, so I assume those 6 were suspicious. Also used AvertLabs software. I have been running for the past 3 days without any problems. The software responsible for all 11 Hooks was listed as Unknown, including the remaining 5 Hooks (though I do not expect I will ever find out what software is causing these last 5 Hooks). Nice code from Rohitlab and I will get around to compiling it in Visual Studio soon, and running it. Thanks for the references. I have also used Rootkit Unhooker to unhook the 5 remaining SSDT Hooks and the only strange event I had soon after was that the Avira AntiVir Premium MailGuard shut down (and I could not get it back except by reinstall/repair and reboot - suspicious eh!). Avira AntiVir will not own up to using Hooks in the SSDT table or using Rootkit technology. Many other companies however, do tag their Hooks so the analysing software will list who is initiating the Hook, a good thing. I am suspicious of companies that do not do this. The 5 Unknown Hooks always return on reboot though. Thanks again.
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds