Update 2012-July

Expect this tool to grow over next couple of months.

Old Post

I was toying around with $MFT parsing and came up with a simple demo tool that parses $MFT looking for remnants of malware. Tool is written in x86 assembly so I guess it is forensically sound

At the moment it only scans for flame malware (I used list from all the places I could find including my own research, CrySyS Lab, Kaspersky, BitDefender, malware.lu, kernelmode.info, etc. -  list pasted below).

It should find entries that are both live (existing files) and deleted entries.

This is how it works – if it is bad news for you:

Note: this is an experimental tool – DO NOT test it on production system. You can always use fls.exe from sleuthkit.

The tool can be downloaded here.

This is a list of files it searches for:

• advnetcfg.ocx
• Advpck.dat
• audache
• audfilter.dat
• authcfg.dat
• authpack.ocx
• boot32drv.sys
• browse32.ocx
• ccalc32.sys
• cmutlcfg.ocx
• commgr32
• comspol32.dll
• comspol32.ocx
• contents.btr
• ctrllist.dat
• dcomm.dat
• desc.ini
• dmmsapi.dat
• dsmgr.ocx
• dstrlog.dat
• Ef_trace.log
• fib32.bat
• frog.bat
• gppref32.exe
• grb9m2.bat
• guninst32
• indsvc32.ocx
• lib.ocx
• lmcache.dat
• lss.ocx
• m4aaux.dat
• modevga.com
• mprhlp
• MSAPackages
• MSAudio
• MSAuthCtrl
• mscrypt.dat
• msglu32.ocx
• mssecmgr.ocx
• MSSecurityMgr
• MSSndMix
• mssui.drv
• mssvc32.ocx
• netcfgi.ocx
• ntaps.dat
• nteps32
• nteps32.ocx
• Pcldrvx.ocx
• rdcvlt32.exe
• Rpcnc.dat
• rpcns4.ocx
• scaud32.exe
• scsec32.exe
• sdclt32.exe
• secindex.dat
• soapr32.ocx
• ssitable
• stamn32
• svchost1ex.mof
• Svchostevt.mof
• target.lnk
• to961.tmp
• urpd.ocx
• watchxb.sys
• wavesup3.drv
• winconf32.ocx
• winrt32.dll
• winrt32.ocx
• wlndh32
• Wpab32.bat
• wpgfilter.dat
• wrm3f0
• zff042
• ~8C5FF6C.tmp
• ~a29.tmp
• ~d43a37b.tmp
• ~DEB83C.tmp
• ~DEB93D.tmp
• ~DF05AC8.tmp
• ~dfc855.tmp
• ~DFD85D3.tmp
• ~DFL*.tmp
• ~DFL983.tmp
• ~dra*.tmp
• ~dra52.tmp
• ~dra53.tmp
• ~f28.tmp
• ~fghz.tmp
• ~HLV
• ~HLV*.tmp
• ~KWI
• ~KWI988.tmp
• ~KWI989.tmp
• ~mso2a0.tmp
• ~mso2a1.tmp
• ~mso2a2.tmp
• ~nms534
• ~rcf0
• ~rcj0
• ~rei524.tmp
• ~rei525.tmp
• ~rf288.tmp
• ~rft374.tmp
• ~TFL848.tmp
• ~TFL849.tmp
• ~ZLM0D1.ocx
• ~ZLM0D2.ocx