4

I seem to remember that rebooting a potentially infected Windows PC before removing the malware may allow it to take advantage of early boot up states that may be vulnerable if the security measures load after the core, thereby deepening its infection level, or making it more difficult to remove. I am not sure if this pertains to a rootkit in particular or not... it may have been describing malware transforming into what is known as a rootkit.

QUESTION: Is this true and does it apply to Android and Windows 7/8/10? How about Linux and Mac?


A FEW QUICK THOUGHTS: On the other hand, I know that a lot of incident response guidelines suggest disconnecting the network cable AND/OR shutsown the computer after discovering or suspecting a malware infections, which is a contradiction to the previous point. In an enterprise environment, technicians may wish to keep the computer alive to preserve forensic evidence, but I also know that most techs will just shut it down and take it back to the shop for the scan. Also of note, is that the most thorough scanning method using a bootable CD would require a restart to load as well.

To be clear, this question is not about incident response, but the capabilities of malware and the consequences of restarting the computer after infection. Incident response guidelines may be offered in addition to your answer where appropriate.

  • 3
    It would depend on the malware and its level of complexity. Normally any malware that has the privileges to alter critical system files (that would be loaded on next reboot) should also be able to compromise a running kernel without requiring a reboot. On the other hand, some malware don't persist at all so by rebooting you're removing all the evidence of the malware being there in the first place. – André Borie Jul 28 '16 at 21:31
  • If you are saying that all components and modules on all levels can be modified without requiring a restart, then I suppose the answer to my question is "No, restarting the computer after being infected does no more harm than not restarting the computer". If the above is the case, then why do OS updates almost always require a restart? (On all platforms) – user58446 Jul 28 '16 at 22:01
  • A restart makes it easier to update all components at once and ensure is is done atomically (either the machine restarts and everything is up to date, or it fails to boot and switches to some rollback routine - there is no "halfway updated" state). However with enough time and effort it is possible to update a system without restarting, and given that malware only makes subtle changes it is relatively easy (than let's say introducing an APi change which running programs won't expect and will fail unpredictably). – André Borie Jul 28 '16 at 23:08
  • It depends on your goal, 1. Clean the machine, 2. Analyze the virus. Choice 1. Rebooting can allow viruses to replace in-use files easier. However, but if you want to cleaning, reformat, reload windows, and rebooting makes no difference. However, if you want to analyze the virus, rebooting could have an impact you want or don't want. If you are there with a network sniffer you may want to reboot and see if it reconnects to command and control server. If the virus is super smart it may detect your on to it, and a reboot may be a signal for the virus to change. – cybernard Jul 29 '16 at 21:55
  • Also it could use a reboot to implant, or activate a previous change, itself in the MBR,GPT, or other critical area. – cybernard Jul 29 '16 at 21:57
1

It depends on the type of malware.

If it is ransomeware shut it down as fast as you can preferably by hard reset this way it may not have been able to encrypt some files and you can grab any files you need off of the hard drive.

If it is a rootkit, shutting down is a horrible idea because the rootkit has set hooks that allows it to climb through rings on the next reboot. Theoretically a rootkit cannot reach ring0 (kernel level) without a restart. (Contrary to some comments above. You'd have to be crazy to try to modify a kernel while it is in use.)

Use how the malware works to determine if it is safe to power off/reboot.

  • It would seem to be difficult to ascertain the true threat level before damage would be done in either case. Ransomware may very well be tricking you into restarting your computer. Do you have a source regarding the Ring 0 protection mechanisms in relation to a restart? – user58446 Sep 5 '16 at 22:04
  • I used to be a part of an OffSec forum that has since gone to trash. But most of the rootkit code shared on that forum required a restart of the system to hook deep enough into the kernel. Has something to do with the windows login screen running as SYSTEM (windows specific example). – Chad Baxter Sep 8 '16 at 16:19
0

Since this question has about a billion comments and no answer, allow me to propose one. In general, if malware gets into a system, take it off the network, shut it down, wipe the drive, and essentially nuke it from orbit.

Although it is true that shutting down may clear out information that might be useful for a forensic analysis, such as data stored in ram, trying to actively remove malware from a system while it's running is just a bad idea. The longer malware exists on your machine, the longer an attacker has to steal/encrypt data, create new backdoors, gain access to other machines on the network, or worse, especially if they start getting red flags that their malicious program is being put on the defensive.

As for restarting, I jokingly mentioned on another post that malware could install a linux iso to a usb plugged into a computer, and the next time the computer rebooted it would boot from the usb if it was on the top of the boot order. Honestly this is a pretty impractical scenario, but it does illustrate the point. Malware can get greater access to a system if it is restarted through plenty of nefarious means like boothooks, rootkits, bootkits, etc. (Just look at the comments on your question for more evil ideas.)

The best option is to do a hard shutdown (i.e. hold the power button, don't give the malware the chance to know that the computer is shutting down (in general give it as little information as possible), disconnect the machine from the network, wipe any attached drives, restore data from a backup from before the malware entered the system or a default company machine image, and figure out how the program got on your machine to start with. Sure, you might have less info to go off of, but the malicious program also will have gathered less information than it might have been able to. And if you really want more information, hopefully you still have server/router logs to comb through.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.