How Does Bd Detect Rootkits?

Methods range among security software providers, but it is usually a combination of several things.

Keep in mind that antivirus products have their own drivers that start with the system and it's much harder to limit a driver.

I hope some of this helps, just as far as general information wise. Rampant is an excellent resource concerning specifics with his greater understanding of malware and AV protection. Georgia or Catalin, if there are any errors in this post, please correct them/me

When Bitdefender Windows 8 version as well as all of the 2013 version implemented ELAM technology for the Windows 8 OS, AV companies who utilize ELAM had to follow Microsoft whitepaper protocols to enable their ELAM to run upon on boot. The bedelam.sys file in the 2013 versions of BD was incorporated a bit later in their release, and can be found in the BD program files (image below) This does scan the drivers upon boot for their classification, and if a bad driver if found will not be allowed to be initialized, i.e also if it is determined the driver is loaded by a rootkit. It does not clean, disinfect etc or require user interaction after windows loads, and does not appear in the BD Log Files.

For Windows 7 OS, you would need to run BD in Rescue mode or a manual scan in Safe Mode (BD Program Files/odscanui), to enable a non-running environment to accomplish a Boot/rootkit scan, compared to running a normal BD Windows System Scan (as well as Auto Scan) which will scan the boot sector and also for rootkits.

--------------------------

--------------------------

This does scan the drivers upon boot for their classification, and if a bad driver if found will not be allowed to be initialized, i.e also if it is determined the driver is loaded by a rootkit. It does not clean, disinfect etc or require user interaction after windows loads, and does not appear in the BD Log Files.

------------------------------

------------------------------

Just to clarify, that is meant while it is still in the ELAM phase.

Rampant, was this during a regular BD System scan in normal running Windows mode?

Look, it's a rootkit, and it was his driver, bitdefender not correctly identifies signature (Gen:Variant.Graftor.121738), hence the removal of this rootkit may not be correct. Maybe experts from the laboratory bitdefender, correct me.

Rootkit.Small

https://www.virustotal.com/ru/file/28a214be...sis/1393864890/

Rootkit.Win32.Small.shu (BD - Trojan.GenericKD.1569638)

https://www.virustotal.com/ru/file/1e7f6a8d...sis/1394537115/

How does BD (or any antivirus, for that matter) detect rootkits?

Rootkits load before the OS and hide themselves from the file system. So, how does BD detect them?

Will BD detect rootkits when run in the normal GUI mode in Windows (Quick scan or System scan)?

Thanks.

Aloke

I'm running Windows 7 (64 bit).

Will I have to run in Rescue Mode to detect all (known to BD) rootkits?

What exactly does Rescue mode do? Any web page that describes this mode of scanning?

Aloke

Hello again

In regards to your concern in your 1st post, I mentioned two ways to scan for Rootkit detection, one being totally outside of the OS (Rescue Mode) and the other in Safe Mode running a manual scan via the odsanui.exe file. They will both scan for rootkits, as shown in the images in post# 4 (minus the Rescue Mode image) Yet, Rescue mode should only be run in more of the crisis circumstances, and not routinely. Here is a link that describes the Rescue Mode with Christian's response: http://forum.bitdefender.com/index.php?s=&...st&p=168133

See also: http://www.bdantivirus.com/bitdefender/ant...ion.rescue.html

Bitdefender's normal System Scan and Autoscan will scan for Rootkits, again, the images in post# 4 show the targets and options for each scan. Will BD get them all, probably not, as Rampant pointed out, but then what AV totally does? Maybe MBAM AntiRootkit scanner is a valid second opinion..but may still be a beta version?

You could also create a custom rootkit scan by Antivirus/Scan Now/Manage Scans/

In my case, yes, it did add something useful to the conversation, Catalin, thanks for that clarification (let alone your other follow up dialogue for Rampant)

I'm sure I speak for all of us in saying, you're welcome, aloke p

In answer to your 1st question; yes, the settings page you see in the screenshots are the default targets and locations that BD scans when doing the scan that are in named red. That is found by going into BD main UI /Events/Antivirus/ and clicking on a scan which will bring up View log. When viewing the log, expand the categories that have a + next to them and it will show you the info. posted in my screenshots.

#2 yes, correct, starting Windows in Safe Mode and running the odscanui.exe will initiate a manual scan, scanning the targets and options shown in the last image.

#3 you're other thread you started had a lot of good questions that are over my head, and would be better fielded by BD Tech support, or a more advanced member here. Just IMHO, the Rescue Mode scan as mentioned by Christian in my other post link, should only be done when necessary, or BD "asks for it". Yet, the nice feature about that version is it's onboard, very easy to click and tick and run, compared to the steps in creating the Rescue CD. Christian also mentions that it is a more advanced alternative to the CD version (more advanced in it's ease of use, or it's scanning abilities?) http://forum.bitdefender.com/index.php?s=&...st&p=133516

I know you probably already know this, but I'll throw it in as a bonus.

To create your own Custom Scan (the image below is just for examples sake), open the BD main UI, on the Antivirus panel click the drop down arrow on Scan Now -> Manage Scans -> New custom scan task -> create a scan name and scan target -> click ok. Now click that scan that's been added to the scan task box, then at the bottom click on Scan Options, set what you want in Advanced/Scan Options then click Custom, and select your way through those options.

edit: sp

Good point, as I couldn't find a detailed log of what was (is) scanned in rescue mode. At least with the Safe Mode scan we have an idea of what is being scanned. In your opinion, does a Safe Mode scan have a better chance in finding rootkits, even in the MBR, is BD able to scan there in Safe Mode?

You're really asking some excellent questions, Aloke. I would be curious about this one, too. Those questions of the effectiveness of the scans and their use, is in the league of more advanced members here, or Catalin, Georgia, Christian etc. to answer. Thanks for doing such a good job in tracking and posting on you're thread

I don't think any answers are forthcoming.

Aloke

Hello ,

Rescue mode of Bitdefender is in fact a separate operating system (Linux) which loads without loading windows and there bitdefender scans for the malware . Since most windows resident malware are start with windows, so remain inactive , are detected and removed easily .

Regards

Akhil