CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

How do you fight Rootkits?

 
Post new topic   Reply to topic       All -> FavForums -> Rootkit Revelations [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
Elendil

Sergeant
Sergeant


Joined: Apr 30, 2006
Posts: 113


PostPosted: Wed Jul 19, 2006 7:10 pm    Post subject: How do you fight Rootkits?
Reply with quote

I was just wondering what all you people out there use to detect and remove rootkits, here are the things I use:

1. Blacklight Beta Rootkit Detector by F-Secure
2. Rootkit Revealer by SysInternals?
3. Anti-Rootkit by GMER

Back to top
View users profile Send private message Visit posters website
wawadave

Special Response Team
Special Response Team

Joined: Nov 22, 2002
Posts: 21503
Location: Installing Vista http://tinyurl.com/2l9qyd
Premium RootKit Detection Hosts Rootkit Responders SRT

PostPosted: Wed Jul 19, 2006 7:42 pm    Post subject:
Reply with quote

1. Blacklight Beta Rootkit Detector by F-Secure
2. Rootkit Revealer by SysInternals?
3. Anti-Rootkit by GMER
4. icesword
5. helios http://helios.miel-labs.com/

best fight i have so far is prevention.


_________________
Brycetechs new tut dvd http://tinyurl.com/2u7rpk
The Pixel Palladium
Bryce Newby help and tuts, d/l,s How 2s Updated 18 Apr 2008
Back to top
View users profile Send private message Send email Visit posters website
negster22

Security Expert
Premium Member

Joined: Mar 10, 2004
Posts: 5394

Moderators MVP Premium RootKit Detection Hosts Rootkit Experts Security Experts SRT

PostPosted: Thu Jul 20, 2006 2:17 am    Post subject:
Reply with quote

I would also add DarkSpy to that list.

Because the different rootkit detectors can focus on different rootkit hiding techniques, it is important to use more than one to rule out a negative result.


_________________
Negster22 - MS MVP - Consumer Security 2006-2008 image
Back to top
View users profile Send private message Visit posters website
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Thu Jul 20, 2006 3:01 am    Post subject:
Reply with quote

So is it advisable to use all six? If not, what would be the minimum recommendation?

Back to top
View users profile Send private message
Guest

Guest
IP: 211.100.*.*






PostPosted: Thu Jul 20, 2006 4:36 am    Post subject:
Reply with quote

Ikeb wrote:
So is it advisable to use all six? If not, what would be the minimum recommendation?

Icesword + DarkSpy + RootkitRevealer
you can't lose any of them.
gmer is too weak.

Back to top
Elendil

Sergeant
Sergeant


Joined: Apr 30, 2006
Posts: 113


PostPosted: Thu Jul 20, 2006 2:10 pm    Post subject: IceSword
Reply with quote

McAfee SiteAdvisor gives the IceSword download site a red rating... are you sure its safe to meddle with?

Back to top
View users profile Send private message Visit posters website
Prince_Serendip

Site Moderator


Joined: Sep 07, 2002
Posts: 17542

1st Responders MIRT Moderators MVP Premium RootKit Detection Hosts Rootkit Experts Rootkit Responders

PostPosted: Thu Jul 20, 2006 2:22 pm    Post subject:
Reply with quote

That's because the site is in mainland China. It's a political stance on their part, and has really nothing to do with security IMO. Not all Chinese sites are bad. McAfee likes to "paint" with a broad brush. Rolling Eyes


_________________
image
Microsoft MVP Consumer Security 2006, 2007 & 2008
Back to top
View users profile Send private message
wawadave

Special Response Team
Special Response Team

Joined: Nov 22, 2002
Posts: 21503
Location: Installing Vista http://tinyurl.com/2l9qyd
Premium RootKit Detection Hosts Rootkit Responders SRT

PostPosted: Thu Jul 20, 2006 3:06 pm    Post subject:
Reply with quote

mcdaffy let sircam virus onto my computer years ago cost 4 months work the definitions were upto date. just not a good program. i rate their advice the same.


_________________
Brycetechs new tut dvd http://tinyurl.com/2u7rpk
The Pixel Palladium
Bryce Newby help and tuts, d/l,s How 2s Updated 18 Apr 2008
Back to top
View users profile Send private message Send email Visit posters website
plunx

Lieutenant
Lieutenant


Joined: Nov 01, 2005
Posts: 194
Location: Sweden

PostPosted: Thu Jul 20, 2006 3:30 pm    Post subject:
Reply with quote

Prince_Serendip wrote:
That's because the site is in mainland China. It's a political stance on their part, and has really nothing to do with security IMO. Not all Chinese sites are bad. McAfee likes to "paint" with a broad brush. Rolling Eyes


Hi

To be a more correct this is beacuse of some strange connections to
other "partners"......some of them believes rootkits are good...

http://www.siteadvisor.com/sites/xfocus.net?aff_id=0

So this is not about to "painting" our world....IMHO

To Elendil
Always check "View Site Details" when using Site Advisor Shocked
Really interrestting to see all junk and all strange connections...

Nevertheless IceSword is a safe download.

regards
plunx
Wink

Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Rootkit Revelations All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer