Most computer users remember rootkits from the Sony BMG scandal a few years ago where the company installed rootkit like features on computer systems that were distributed with several of their music CDs. Rootkits are still not considered a huge threat by many. It is more likely to get infected by a computer virus or trojan than by a rootkit. Rootkits have been designed to hide on a computer system to prevent detection by normal security programs and system tools which makes them dangerous.
Codewalker is a rootkit detection software that has been developed by a member of the Sysinternals forum. The current version that has been released today is 0.24b which clearly outlines that the software program is a work in progress. It is a portable software that can be run from the local drives or removable devices.
The security program suggests a deep scan of the computer system upon startup which takes a few minutes to complete. It is possible to avoid this deep scan which will lead directly to the main program interface. The main interface uses tabs to display various information including system processes, hidden code, kernelmode and usermode hacks.
The connected disk drives are displayed on the right side with the option to select some or all of them for a scan. The same scan that was suggested upon program start will then be performed. The results are shown in the various tabs after the scan has finished.
The developer explains his program:
For hidden driver detection, you can test it with some pretty well hidden driver PoC such as phide_ex and many builds of Rustock.B variants. Although you have to use the “Hardcore Scan” method to detect them.
For code hooking detection, the engine walks all the branches of scanned module i.e any execution path of it to detect modification (btw, that’s why i call it CodeWalker). IMHO, It can detect code hooking very well especially with rootkits that place abnormal hooks like Rustock.C (FF25 & FF15 – jmp/call dword ptr [abc]) tho there’re still some problems with false-positive hooks/modifications.
Codewalker is a viable alternative to already available rootkit detection programs like Gmer or AVG Anti-Rootkit. It is probably be best used in conjunction with these tools.
Related posts:
- AVG Anti Rootkit free
- Trend Micro RootkitBuster
- IceSword the better Rootkit Revealer ?
- Which Programs Should I Run To Scan A Computer For Malicious Software?
- Microsoft Rogue Detection Tool
- Antivirus software Uninstaller AppRemover
- Dvd Rootkit on the way
- How to remove the Sony – XCP DRM Rootkit
AVG Anti Rootkit free is no longer available, so this might be a valuable replacement.
RootkitRevealer
http://technet.microsoft.com/nl-nl/sysinternals/bb897445(en-us).aspx
avg still good here
i download and it find bugs
http://www.brothersoft.com/avg-anti-rootkit-free-60621.html