|
View: 4081|Reply: 8
|
ROOTKIT : anti-rootkit /rootkit revealer
[Copy link]
|
|
|
http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx
RootkitRevealer v1.71
By Bryce Cogswell and Mark Russinovich
Published: November 1, 2006
Download RootkitRevealer (231 KB)
Introduction
RootkitRevealer is an advanced rootkit detection utility. It runs on Windows NT 4 and higher and its output lists Registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit. RootkitRevealer successfully detects many persistent rootkits including AFX, Vanquish and HackerDefender (note: RootkitRevealer is not intended to detect rootkits like Fu that don't attempt to hide their files or registry keys). If you use it to identify the presence of a rootkit please let us know!
The reason that there is no longer a command-line version is that malware authors have started targetting RootkitRevealer's scan by using its executable name. We've therefore updated RootkitRevealer to execute its scan from a randomly named copy of itself that runs as a Windows service. This type of execution is not conducive to a command-line interface. Note that you can use command-line options to execute an automatic scan with results logged to a file, which is the equivalent of the command-line version's behavior.
What is a Rootkit?
The term rootkit is used to describe the mechanisms and techniques whereby malware, including viruses, spyware, and trojans, attempt to hide their presence from spyware blockers, antivirus, and system management utilities. There are several rootkit classifications depending on whether the malware survives reboot and whether it executes in user mode or kernel mode.
Persistent Rootkits
A persistent rootkit is one associated with malware that activates each time the system boots. Because such malware contain code that must be executed automatically each system start or when a user logs in, they must store code in a persistent store, such as the Registry or file system, and configure a method by which the code executes without user intervention.
Memory-Based Rootkits
Memory-based rootkits are malware that has no persistent code and therefore does not survive a reboot.
User-mode Rootkits
There are many methods by which rootkits attempt to evade detection. For example, a user-mode rootkit might intercept all calls to the Windows FindFirstFile/FindNextFile APIs, which are used by file system exploration utilities, including Explorer and the command prompt, to enumerate the contents of file system directories. When an application performs a directory listing that would otherwise return results that contain entries identifying the files associated with the rootkit, the rootkit intercepts and modifies the output to remove the entries.
The Windows native API serves as the interface between user-mode clients and kernel-mode services and more sophisticated user-mode rootkits intercept file system, Registry, and process enumeration functions of the Native API. This prevents their detection by scanners that compare the results of a Windows API enumeration with that returned by a native API enumeration.
Kernel-mode Rootkits
Kernel-mode rootkits can be even more powerful since, not only can they intercept the native API in kernel-mode, but they can also directly manipulate kernel-mode data structures. A common technique for hiding the presence of a malware process is to remove the process from the kernel's list of active processes. Since process management APIs rely on the contents of the list, the malware process will not display in process management tools like Task Manager or Process Explorer. |
|
|
|
|
|
|
|
|
|
|
|
|
pakai ajer Avast...mmg anti rootkit...boleh scan luar windows...kalau tidak berjuta kali delete ...virus tetap ada... |
|
|
|
|
|
|
|
|
|
|
|
sbenarnya aku pun tktau apa rootkit sbenarnya.
sapa2 bleh explain tak?  
tools yg ada kat atas tu ialah utk selongkar system windows korang dan cari "rootkit". apa itu root kit? aku quote ayat kat atas : "mechanisms and techniques whereby malware, including viruses, spyware, and trojans, attempt to hide their presence from spyware blockers, antivirus, and system management utilities.".
so, rasanya berbeza dari hijackthis. sbb scan log dia totally tak sama, dan rootkit scanner ni bleh scan hddisk tambahan aku yg lain, sedangkan hijackthis cuma scan system windows aje...
ada sapa2 bleh bg maklumat tambahan, cemana nk guna ini rootkit? kredit tambahan menanti korang...  |
|
|
|
|
|
|
|
|
|
|
|
thanks abgboroi...
skrg ni kalu dah jumpa rootkit, cemana naktau which one threats or not? mana 1 nk delete? dah jadi cam hijackthis plak... 
tkpe, aku cari rootkit detector ghostbuster/blacklight sat... test.... |
|
|
|
|
|
|
|
|
|
|
|
kalu pakai malicious software removal tools bleh buang x rootkit nih?
 |
|
|
|
|
|
|
|
|
|
|
|
aku selalu bile bukak internet avast detect rootkit..ape maknenyer tue..aku bukan taw pe2 ha..plez explaian kan kat aku |
|
|
|
|
|
|
|
|
|
| |
|
Post time 6-1-2010 10:29 PM
变色卡
Author
