Full Disclosure mailing list archives
re: Question: Need Suggestions (sorry)
From: Dave Alanis <SDALAN04 () smumn edu>
Date: Mon, 17 Apr 2006 19:10:06 -0500
Sorry for the redundant information I just posted. I meant to say rootkitty: RootKitty is a very simple utility that makes a file listing when running from windows and a file listing from PE/ubcd4win then compares the two files and shows you the differences (looking for rootkits). This is exactly what RootKitty does. RootKitty only scan for files right now although I might add registry scanning sometime soon. Note: there will be some false positives. Also, this does not detect stealth software that hides in BIOS, Video card EEPROM, disk bad sectors, Alternate Data Streams, etc. The same goes for RootKitty so don't just delete anything that it finds! Here's the link: http://EzPcFix.net/dload/RootKitty.exe Here's how to use it: 1. Boot into windows and click on "Win-Scan". The mouse pointer will turn into an hourglass and a dos box will open. You have to wait until the dos box disappears and the mouse pointer goes back to normal before closing the program. This can take quite a while if you have alot of files. 2. Boot into ubcd4win and click on "PE-Scan" and wait for it to finish 3. Click on "Compare" If a file was detected in PE/ubcd4win and was stealthed from windows then it'll show up in the listbox. "Great Spirits Have Always Encountered Violent Opposition From Mediocre Minds" - Einstein "Cuanta estupidez en tan poco cerebro!" _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- re: Question: Need Suggestions (sorry) Dave Alanis (Apr 17)
- RE: Question: Need Suggestions (sorry) y0himba (Apr 17)