gHacks technology news » rootkit-scanner http://www.ghacks.net A technology blog covering software, mobile phones, gadgets, security, the Internet and other relevant areas. Tue, 24 Nov 2009 23:31:44 +0000 http://wordpress.org/?v=2.8.6 en hourly 1 Rootkit Detection Software Codewalker http://www.ghacks.net/2009/04/29/rootkit-detection-software-codewalker/ http://www.ghacks.net/2009/04/29/rootkit-detection-software-codewalker/#comments Wed, 29 Apr 2009 11:17:49 +0000 Martin http://www.ghacks.net/2009/04/29/rootkit-detection-software-codewalker/ rootkit detectionMost computer users remember rootkits from the Sony BMG scandal a few years ago where the company installed rootkit like features on computer systems that were distributed with several of their music CDs. Rootkits are still not considered a huge threat by many. It is more likely to get infected by a computer virus or trojan than by a rootkit. Rootkits have been designed to hide on a computer system to prevent detection by normal security programs and system tools which makes them dangerous.

Codewalker is a rootkit detection software that has been developed by a member of the Sysinternals forum. The current version that has been released today is 0.24b which clearly outlines that the software program is a work in progress. It is a portable software that can be run from the local drives or removable devices.

rootkit detection codewalker

The security program suggests a deep scan of the computer system upon startup which takes a few minutes to complete. It is possible to avoid this deep scan which will lead directly to the main program interface. The main interface uses tabs to display various information including system processes, hidden code, kernelmode and usermode hacks.

The connected disk drives are displayed on the right side with the option to select some or all of them for a scan. The same scan that was suggested upon program start will then be performed. The results are shown in the various tabs after the scan has finished.

The developer explains his program:

For hidden driver detection, you can test it with some pretty well hidden driver PoC such as phide_ex and many builds of Rustock.B variants. Although you have to use the “Hardcore Scan” method to detect them.

For code hooking detection, the engine walks all the branches of scanned module i.e any execution path of it to detect modification (btw, that’s why i call it CodeWalker). IMHO, It can detect code hooking very well especially with rootkits that place abnormal hooks like Rustock.C (FF25 & FF15 – jmp/call dword ptr [abc]) tho there’re still some problems with false-positive hooks/modifications.

Codewalker is a viable alternative to already available rootkit detection programs like Gmer or AVG Anti-Rootkit. It is probably be best used in conjunction with these tools.

Tags: , , , , , ,

Related posts

]]> http://www.ghacks.net/2009/04/29/rootkit-detection-software-codewalker/feed/ 4 Check a system for rootkits with Gmer http://www.ghacks.net/2007/05/06/check-a-system-for-rootkits-with-gmer/ http://www.ghacks.net/2007/05/06/check-a-system-for-rootkits-with-gmer/#comments Sun, 06 May 2007 17:18:00 +0000 Martin http://www.ghacks.net/2007/05/06/check-a-system-for-rootkits-with-gmer/ Gmer is primary a free rootkit scanner which offers additional functionality such as offering an Intrusion Prevention System and a Firewall. The interface looks very user friendly but the settings, options and the results require at last basic knowledge of rootkits and other means of harming the system to apply and interpretate them in the correct way. Gmer does notify the user if it spots something suspicious and displays those results in red in the main window. The two screenshots below show two typical scan results after performing a scan of your computer with Gmer.

gmer rootkit scanner rootkit scanner

As I said earlier, running Gmer is really easy. Just start the application and click on the scan button. Gmer does scan the system automatically and displays the results in the main window. If you spot red entries you should try and search the Internet for clues about them. It is possible to kill processes, service and files by right-clicking an entry in the main window.

Next to scanning for Rootkits you can also scan for Autostart entries, check running processes, services and modules and activate the Intrusion Prevention System and the Firewall. Take a look at this nice Gmer tutorial which walks you through a basic process.

Tags: , ,

Related posts

]]> http://www.ghacks.net/2007/05/06/check-a-system-for-rootkits-with-gmer/feed/ 2 AVG Anti Rootkit free http://www.ghacks.net/2007/04/05/avg-anti-rootkit-free/ http://www.ghacks.net/2007/04/05/avg-anti-rootkit-free/#comments Thu, 05 Apr 2007 08:46:31 +0000 Martin http://www.ghacks.net/2007/04/05/avg-anti-rootkit-free/ Rootkits received a publicity boost with Sony’s rootkit infested CDs that was supposed to be some kind of copy protection. Since then rootkits have become an ever growing threat on the Internet in line with Viruses, Trojans, Phishing and Spam. The major problem with rootkits is that most users think that their virus scanner protects them from rootkits as well which is most of the time not the case. Rootkits are much harder to detect by normal means and software that can scan systems for rootkits should be used by inexperienced users to be able to detect at least the most common ones.

AVG Anti Rootkit is a free software that scans a computer for rootkits and removes them if one or more of those have been identified. The anti rootkit application can be used to either quickly scan the computer for possible rootkits and the other to make an in depth scan which takes longer but is more thorough. The in depth scan for Rootkits takes some time depending on the amount of files and size of your hard drives.

Tags: , , , ,

Related posts

]]> http://www.ghacks.net/2007/04/05/avg-anti-rootkit-free/feed/ 3