Ukuthola izinqubo ezifihliwe kanye nama-rootkit ku-Windows akuwona umsebenzi olula: ngokwencazelo, le malware izifihla ngaphakathi ohlelweni ukuze igweme isofthiwe ye-antivirus, ifihle izinqubo, amafayela, kanye nezihluthulelo zokubhalisa, futhi inikeze umhlaseli ukulawula okuphelele. Noma kunjalo, ngendlela ehlelekile, amathuluzi afanele, kanye nemikhuba emihle kakhulu, kungenzeka ukuthola izimpawu zokuyekethisa, ukuqinisekisa ukutheleleka, kanye nokukubulala amagciwane.
Kulesi siqondisi esisebenzayo uzothola izindlela eziqinisekisiwe, amathuluzi akhethekile kanye nezinyathelo eziqondile zokuhlonza ukuziphatha okungajwayelekile, ukuskena ama-rootkit ku-Windows (kanye naku-Linux/macOS), ukuhumusha imiphumela, futhi uma kudingeka, ususe izifo eziyinkimbinkimbi, okuhlanganisa nalezo ezithinta inqubo yokuqalisa noma ngisho ne-firmware.
I-Rootkit: Iyini, ifaka kanjani, nokuthi kungani izifihla kahle
I-rootkit iyisofthiwe enonya eyenzelwe ukunikeza ngokufihla amalungelo omlawuli (impande) . Ingasebenza kwimodi yomsebenzisi noma kwimodi ye-kernel, ihlale kwimemori, ku-bootloader, noma ngisho naku-firmware/BIOS/UEFI. Umgomo wayo ukuqhubeka, ukungabi khona, nokuvumela izenzo ezifana nokwebiwa kwedatha, ukufakwa kwe-malware eyengeziwe, ukukhubaza izinyathelo zokuphepha, noma ukwengeza idivayisi ku-botnet yokuhlaselwa kwe -DDoS noma ugaxekile.
Abahlaseli bayifaka ngokusebenzisa i-phishing kanye nobunjiniyela bezenhlalo , ukuxhashazwa kobuthakathaka ezinhlelweni noma ezinhlelweni zokusebenza eziphelelwe yisikhathi, amaphakheji anonya afihliwe (njenge-PDF noma isifaki esiqhekekile), noma amadivayisi asuswayo asengozini. Uma ingaphakathi, iguqula imisebenzi yesistimu ukuze ifihle izinqubo, amafayela, kanye nezikhiye zokubhalisa , futhi ezimweni ezithuthukile, ingavimba ithrafikhi, ithwebule izithombe-skrini, ibhale phansi ama-keystrokes, noma ikhubaze isofthiwe ye-antivirus.
Izinhlobo ezivame kakhulu zama-rootkits ukuthola izinqubo ezifihliwe
Kunemindeni eminingana yezinambuzane, ezihlukaniswa ngezinga ezisebenza ngalo kanye nokuphikelela kwazo. Lokhu kuhlukaniswa kusiza ekukhetheni indlela yokuthola ephumelela kakhulu kanye nesu lokuqeda.
I-Hardware/I-Firmware
Zithinta i-BIOS/UEFI, ama-router, ama-disk, nezinye izingxenye . Azithinti ngqo uhlelo lokusebenza: zizifaka ku-firmware, okwenza kube nzima kakhulu ukuzithola futhi zingase zivumele ukuthi ziqhubeke ngisho nangemva kokufaka kabusha i-Windows.
I-Bootloader (ama-bootkits)
Bashintsha umkhakha wokuqalisa (i-MBR/UEFI) noma bashintshe i-bootloader yesistimu esemthethweni. Bayasebenza ngaphambi kokuba uhlelo lokusebenza luqede ukuqala, okubanika ithuba lokuhlala befihliwe.
Imemori (isakhamuzi se-RAM)
Zihlala ku- RAM futhi azifaki ikhodi ehlala njalo kudiski. Ngokuvamile ziyanyamalala lapho ziqala kabusha, yize zingaphazamisa ukuhlaziywa okubukhoma uma kungenziwa ngokushesha.
Izinhlelo zokusebenza (imodi yomsebenzisi)
Bashintsha noma banamathisele amafayela ezinhlelo zokusebenza ezivamile (i-Office, i-Notepad, i-Paint, njll.) futhi bashintsha ukuziphatha kwabo ukuze kuvuleke "umnyango" kumhlaseli njalo lapho eqhutshwa.
Imodi ye-Kernel
Zizifaka ku- kernel yesistimu yokusebenza , zibambe ama-API omdabu, futhi zingalawula izakhiwo ze-kernel (isibonelo, ukufihla inqubo ohlwini lwezinqubo ezisebenzayo). Ziyingozi kakhulu.
Virtual
Zifakwe ngaphansi kwesistimu yokusebenza, ziyisebenzisa emshinini obonakalayo ukuze zivimbele ukusebenzisana kwayo nehadiwe ngaphandle kokuthinta i-kernel. Kunzima ukuzithola.
Izibonelo ezaziwayo
Ukuze uqonde umthelela wayo, bheka izimo zangempela: i-Stuxnet (ukubhujiswa kwezimboni kanye nokuphathwa ngokuyimfihlo), i-Flame (ubunhloli be-inthanethi ngomsindo, isikrini kanye nokuthwebula ukhiye), i-Necurs (i-rootkit ethuthukisiwe exhunywe kuma-botnets), i-ZeroAccess (imodi ye-kernel, i-malware elandiwe ukuze ihlanganise amakhompyutha nama-botnets) noma i-TDSS/TDL-4 (ukulayisha kwasekuqaleni lapho kuqala kanye nobunzima obukhulu bokususa).
Izimpawu eziyisixwayiso: izimpawu ezimema uphenyo
Ama-Rootkit aklanyelwe ukungabonwa , kodwa avame ukushiya iminonjana. Uma ubona eziningana zalezi zimpawu, sekuyisikhathi sokuzihlola ngokucophelela:
- I-BSOD noma amaphutha avamile kanye nokuqalisa kabusha okungalindelekile.
- Ukusebenza okungavamile: Ukunensa, ukuphahlazeka, ukusetshenziswa okuphezulu kwe-CPU/RAM ngaphandle kwesizathu.
- Ukuziphatha kwesiphequluli okungajwayelekile: : ukuqondisa kabusha, amabhukumaka angaziwa.
- Izinguquko ezingagunyaziwe ku-Windows: ingemuva, ibha yomsebenzi, idethi/isikhathi, i-antivirus ivaliwe.
- Izinkinga zenethiwekhi: Ukwehla kwezikhawu, ithrafikhi ephezulu, noma ukuxhumana ongakwazi.
IWindows: Amathuluzi Nezindlela Ezisebenzayo
I-Windows ayinawo umyalo wendabuko "othola" ama-rootkit ngomlingo, kodwa inesethi yezinsiza ezikhethekile kanye namathuluzi okuqhathanisa ukubuka okuphezulu/okuphansi asebenza kahle kakhulu uma ehlanganiswa nemikhuba emihle.
1) Ama-Sysinternals: I-Process Explorer, i-Autoruns kanye ne-Process Monitor
I-Process Explorer ilungele ukuhlola izinqubo kanye nomuthi wazo, iziginesha zedijithali, amamojula, kanye nomsebenzi. Yisebenzise ukuthola izinqubo noma izinqubo ezingasayiniwe ezinezindlela ezisolisayo futhi uqinisekise idumela lazo.
cunt Ama-Autoruns Uhlola ngokuphelele yonke into esebenza ekuqaleni (izinkonzo, imisebenzi, izandiso zegobolondo, abashayeli). Susa ukumaka noma susa okufakiwe okungaziwa futhi ibukeza izindlela ezibucayi njenge HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
I-Process Monitor (ProcMon) iqapha amafayela, irejista, kanye nokusebenza kwenqubo ngesikhathi sangempela. Ihlunga izinqubo ezifihliwe ukuthola ukufinyelela okungajwayelekile ezindleleni zesistimu noma okhiye bokuqala.
2) I-RootkitRevealer (Sysinternals): ukuqhathanisa kwezinga eliphansi neliphezulu
I-RootkitRevealer ibona ukungafani phakathi kwalokho okubonwa yi-Windows API nalokho okukudiski/irejistri ezingeni eliphansi. Lokhu kwembula izindlela ezivamile zokufihla ezisetshenziswa yi-user-mode kanye ne-kernel rootkits.
Ukusebenza: Iqhathanisa umbono "wezinga eliphezulu" (i-API) nombono "wezinga eliphansi" (okuqukethwe okungavuthiwe kwamavolumu e-FAT/NTFS kanye nezihlahlana ze-Registry). Uma i-rootkit ilawula i-API ukuze ifihle amafayela noma okhiye, izobonakala njengokungafani phakathi kwemibono emibili.
Ukusetshenziswa okuyisisekelo: Ukuze unciphise amaphuzu angamanga, aqalise ngawo Amalungelo wokuphatha, ngohlelo olungasebenzi ngangokunokwenzeka futhi, uma kunesidingo, qalisa a scan auto ngezinketho:
rootkitrevealer -a -c -m -r C:\ruta\salida.log
Izinketho ezitholakalayo:
-a (hlola bese uphuma), -c (Okukhiphayo kwe-CSV), -m (bonisa imethadatha ye-NTFS), -r (ungahloli iRegistry). Futhi isekela ukukhishwa okukude nge-PsExec:
psexec \\equipo-remoto -c rootkitrevealer.exe -a C:\Windows\System32\rootkit.log
Ukuhunyushwa kwemiphumela: Kufanele uphenye ukushayisana ngakunye. Ezinye ezivamile yilezi:
Kufihliwe ku-Windows API (okujwayelekile kwama-rootkits), Ubude bevelu lokubhalisa obungahambisani, ukungafani kohlobo lwedatha, amagama anama-NULL ashumekiwe (okhiye ababonakala ohlelweni kodwa hhayi kumathuluzi afana ne-Regedit), noma ukungezwani phakathi kwe-API, i-MFT nenkomba yohlu lwemibhalo (amafayela adalwe/asusiwe ngesikhathi sokuskena).
Qaphela ukuthi imiqulu ye-NTFS ifihlekile ngokusemthethweni amafayela wemethadatha (Uma uzivumela ukuthi ziboniswe, ungathuki uma uzibona.) Lokhu kufaka phakathi:
$AttrDef, $BadClus, $BadClus:$Bad, $BitMap, $Boot, $LogFile, $Mft, $MftMirr, $Secure, $UpCase, $Volume, $Extend, $Extend\$Reparse, $Extend\$ObjId, $ExtendJ$U, $Extend\$UsnJrnl:$Max, $Extend\$Quota.
Imikhawulo: Ayikho i-universal scanner . Esebenza kahle kakhulu ihlanganisa ukuqhathanisa okuku-inthanethi/okungaxhunyiwe ku-inthanethi nesofthiwe ye-antivirus. Ukuze uthole ukuthembeka okuphezulu, sebenzisa ama-scan kusuka kumidiya ebhuthwayo ethembekile.
3) Izikena ezizinikezele ze-anti-rootkit
Ihlanganisa amathuluzi amaningana, njengoba ngalinye lihlanganisa imindeni ehlukene kanye namasu athile:
- I-Malwarebytes Anti-Rootkit: Iwusizo ekuhloleni okugcwele. Ikuvumela ukuthi udale iphoyinti lokubuyisela futhi uqalise Hlanza ngemva kokubona izinsongo.
- I-GMER- Inamandla kakhulu ekutholeni imicu/izinqubo ezifihliwe kanye nokukhohlisa kwe-kernel. Qaphela: Kube nemibiko yokuhambisana okulinganiselwe Windows 11.
- Kaspersky TDSSKiller: specialized in I-TDSS/TDL kanye nama-bootkits.
- I-Windows Defender Offline: qalisa ngaphandle kweWindows ukuze uskene ngaphambili ukuthi uhlelo olungayilungele ikhompuyutha lulayishiwe.
- RogueKiller: Iwusizo ezinqubweni ezifihliwe, okhiye bokubhalisa abashintshiwe, kanye ne-MBR esolisayo.
Icebiso lokusebenza: Qalisa kabusha ku-Safe Mode ngaphambi kokuskena (faka abashayeli nama-hook ambalwa), bese ubeka phambili ukuqala kabusha kusuka ku -USB uma usola ama-bootkit/firmware.
4) Inethiwekhi nokuxhumana: i-netstat ne-Wireshark
Uhlelo olungayilungele ikhompuyutha olufihliwe ngokuvamile luxhumana nomhlaba wangaphandle. Qalisa i-CMD njengomlawuli. netstat -ano ukuze ufake kuhlu uxhumano nama-PID ahlobene, nama-PID abhekisela kwezinye nge-Process Explorer.
Ukuhlaziya ngokujulile, I-Wireshark Ikuvumela ukuthi uthwebule ithrafikhi. Khetha isixhumi esibonakalayo (Wi-Fi/Ethernet), qala ukuthwebula, hlunga ngaso ip.addr == TU_IP noma ngamaphrothokholi (isibonelo, http) bese uhlola IPs/izimbobo Okungaziwa. Yeka ukuthwebula lapho unokubalulekile okufanele ukubuyekeze ngesikhathi uzipholele.
5) Umkhakha wokuvula nokulungisa
Uma usola i-bootkit, qalisa nge- Imidiya yokufaka iWindows, khetha "Lungisa ikhompuyutha yakho" bese uvula ikhonsoli ukuze uyisebenzise: bootrec /fixmbr. Lesi sinyathelo can buyisela i-MBR umshado.
6) Uma kungekho lutho olusebenzayo: faka kabusha hlanzekile
Uma ukutheleleka okujulile noma okuqhubekayo, ukufaka kabusha okuhlanzekile kuyisisombululo esithembekile . Sebenzisa isifaki senkampani yangaphandle futhi ugweme ukubuyisela izinhlelo/ukucushwa okudala ngaphandle kokuskena. Uma ukuhlaselwa kuthinte i-BIOS/UEFI, kuzodingeka ukhanyise i-firmware usebenzisa uhlelo olusemthethweni lomenzi.
I-RootkitRevealer: Izidingo, Izinketho, kanye Nemikhuba Engcono Kakhulu
Ukuze uyisebenzise ngokuphephile, yisebenzise nge-akhawunti enamalungelo okuthi "Yenza isipele samafayela neziqondisi," "Layisha abashayeli," kanye "nemisebenzi yokulungisa ivolumu" (Abaphathi banawo ngokuzenzakalelayo). Vala izinhlelo zokusebenza bese ushiya uhlelo lungasebenzi ngesikhathi sokuskena ukuze unciphise imiphumela engamanga.
Khumbula ukuthi i-RootkitRevealer ayisebenzisi izihlungi zokukhipha (ama-rootkit angasebenzisa lokhu). Uma ubona " Ukufinyelela kunqatshelwe ," akuvamile, njengoba ithuluzi lisebenzisa izindlela zokufunda noma yiliphi ifayela, isiqondisi, noma ukhiye wokubhalisa. Chaza ukungafani phakathi kwe-API, i-MFT, kanye nenkomba ngokucophelela: lawa kungaba amafayela adalwe noma asuswe ngesikhathi sokuskena.
Amanye amapulatifomu: Linux kanye ne-macOS
Nakuba okugxilwe kulo mhlahlandlela kuyi-Windows, kuyasiza ukujwayelana namathuluzi wezinye izinhlelo. Ku-Linux naku-macOS, ungasebenzisa chkrootkit y rkhunter ukuzingela ama-rootkits aziwayo, izinguquko kanambambili, nama-backdoors.
Ukufakwa okujwayelekile ku-Debian/Ubuntu: sudo apt-get install chkrootkit y sudo apt-get install rkhunter. Gijima ./chkrootkit o rkhunter -c futhi uhlole izexwayiso ezibomvu. Gcina uhlelo kucishiwe futhi kwabuyekezwa con sudo apt update && sudo apt upgrade ukwandisa ukusabalala ngokumelene nezinhlobonhlobo ezintsha.
Ukususa ama-suites nezinsiza
Ngaphezu kwezikena okukhulunywe ngazo ngenhla, ungathembela kumathuluzi aziwayo njenge- Avast Rootkit Scanner (ukuhlaziywa kwesiginesha, inkumbulo, kanye ne-DLL), i-Malwarebytes (ukutholwa kwama-rootkit, i-adware, i-spyware, kanye ne-kernel integrity anomalies), i-Lynis (ukuhlolwa kokuphepha kwe-Linux/BSD), i-MalwareFox (ukutholwa kwama-keylogger kanye neminyango yangemuva okusekelwe efwini), kanye ne -Sophos (ukuhlaziywa kokuziphatha kanye nokuvikelwa kwezihluthulelo ze-Registry ukuvimbela ukutheleleka kabusha).
Ezimweni ezithile, izinsiza ezifana neKaspersky Virus Removal Tool/TDSSKiller noma iKaspersky Rescue Disk ziye zabonakala zisebenza kahle emindenini ethile yamagciwane (isb., i-TDSS). Uma kudingeka, iWindows Defender Offline inikeza umbono wesibili ngokuqalisa kabusha ngaphandle kwesistimu yokusebenza.
Ukuvimbela: Vala iminyango futhi uqinise isiqalisi
Isivikelo esingcono kakhulu ukuvimbela i-rootkit ukuthi ingafiki ohlelweni lwakho. Gcina i-Windows nezinhlelo zakho zokusebenza zibuyekeziwe , vumela i-Secure Boot kanye ne -TPM kuzilungiselelo zakho ze-BIOS/UEFI, khawulela amalungelo (i-PoLP), gwema ukuqhekeka kanye nesofthiwe ephangiwe, bese ukhubaza i-USB autorun . Setha ama-backups avamile futhi, uma kungenzeka, uwagcine ungaxhunyiwe ku-inthanethi.
Thuthukisa ukubonakala: I-SIEM ezindaweni zezinkampani, ukubuyekezwa okuvamile nge- Sysinternals Suite , amaphuzu okufingqa/ukubuyisela, kanye nokuqapha ukuziphatha. Isixazululo sokuphepha esinezingqimba eziningi esinokutholwa okusekelwe esiginesha kanye nokuziphatha kunciphisa kakhulu ingozi.
Izimpawu, ukuqinisekiswa kanye nokusabela okusheshayo
Uma usola ukuthi kukhona ukutheleleka: nqamula inethiwekhi, sebenzisa ukuskena okungaxhunyiwe ku-inthanethi usebenzisa imidiya ethembekile, hlanganisa amathuluzi amaningana e-anti-rootkit, susa okufakiwe kwe-boot, bese uqinisekisa i-MBR/UEFI. Uma uhlelo lusengozini enkulu noma umhlaseli egcina ukulawula okukude, ukufometha nokufaka kabusha konga isikhathi futhi kuvimbele ukutheleleka kabusha.
Ezimweni ezibucayi noma uma i-firmware ibonakala isengozini, cabanga ngokusekelwa kochwepheshe . Ezinye izitolo zokulungisa zinikeza ukuhlolwa kokuqala futhi, uma ukulungiswa kuvunyiwe, zivame ukukhipha izindleko entengweni yokugcina (imigomo iyahlukahluka ngomhlinzeki; hlola kusengaphambili ukuze ugweme ukumangala).
Amanothi okusebenza nama-nuances abalulekile
Amanye amathuluzi (njenge-GMER) angakhiqiza imiphumela engamanga noma abangele ukungazinzi ezinhlelweni zesimanje; wasebenzise ngokuqapha. Ungasebenzisi izikena eziningi ezisindayo ngesikhathi esisodwa; zisebenzise ngokulandelana . Dala indawo yokubuyisela ngaphambi kokuhlanza bese ubhala izinguquko (uhlu lokuqalisa, abashayeli, imisebenzi) uma kwenzeka udinga ukuzibuyisela emuva.
Khumbula ukuthi akukho lutho oluwusizo : ukuhlanganisa ukuhlaziywa kokuziphatha, ukuskena ungaxhunyiwe ku-inthanethi, kanye nokuqhathaniswa kwezinga eliphezulu/eliphansi (njengoba kwenza i-RootkitRevealer) kunikeza isembozo esingcono kakhulu. Uma uqinisekisa ukuba khona kwe-rootkit futhi ungenayo inqubo ecacile yokususa, cabanga kabusha ngokusebenzisa amathuluzi okusindisa bese wenza ukufakwa kabusha okuhlanzekile.
Isikhumbuzi sokutholwa kokuziphatha kwezinqubo ezifihliwe
Ukutholwa okusekelwe ekuziphatheni kubheka amaphethini ajwayelekile e-rootkit (ama-API hooks, ukufihla izinto, ama-startup asolisayo) ngaphambi kokuba kube nezimpawu ezisobala kumsebenzisi. Kuyinhlanganisela enhle kuma-scan aqondiwe lapho uhlelo lusabonakala "lujwayelekile."
Ama-Rootkit ayizitha ezinzima, kodwa awanqotshwa. Ngokuhlala uqaphile , amathuluzi afanele, ukuqalisa okuphephile, ama-patches asesikhathini, kanye nemikhuba ehlakaniphile (akukho mifantu, ama-backup, kanye nokuhlaziya noma yikuphi ukungahambi kahle), ungathola izinqubo ezifihliwe, ukhubaze iminyango yangemuva, futhi ubuyisele ukulawula kwekhompyutha yakho kumuntu obekungafanele akulahlekele: wena. Yabelana ngalo mhlahlandlela ukuze abasebenzisi abaningi bafunde ukuthola izinqubo ezifihliwe ku-Windows.