gHacks Technology News | Latest Tech News, Software And Tutorials » rootkit-scanner

Rootkit Detection Software Codewalker

Martin Brinkmann — Wed, 29 Apr 2009 11:17:49 +0000

Most computer users remember rootkits from the Sony BMG scandal a few years ago where the company installed rootkit like features on computer systems that were distributed with several of their music CDs. Rootkits are still not considered a huge threat by many. It is more likely to get infected by a computer virus or trojan than by a rootkit. Rootkits have been designed to hide on a computer system to prevent detection by normal security programs and system tools which makes them dangerous.

Codewalker is a rootkit detection software that has been developed by a member of the Sysinternals forum. The current version that has been released today is 0.24b which clearly outlines that the software program is a work in progress. It is a portable software that can be run from the local drives or removable devices.

The security program suggests a deep scan of the computer system upon startup which takes a few minutes to complete. It is possible to avoid this deep scan which will lead directly to the main program interface. The main interface uses tabs to display various information including system processes, hidden code, kernelmode and usermode hacks.

The connected disk drives are displayed on the right side with the option to select some or all of them for a scan. The same scan that was suggested upon program start will then be performed. The results are shown in the various tabs after the scan has finished.

The developer explains his program:

For hidden driver detection, you can test it with some pretty well hidden driver PoC such as phide_ex and many builds of Rustock.B variants. Although you have to use the “Hardcore Scan” method to detect them.
For code hooking detection, the engine walks all the branches of scanned module i.e any execution path of it to detect modification (btw, that’s why i call it CodeWalker). IMHO, It can detect code hooking very well especially with rootkits that place abnormal hooks like Rustock.C (FF25 & FF15 – jmp/call dword ptr [abc]) tho there’re still some problems with false-positive hooks/modifications.

Codewalker is a viable alternative to already available rootkit detection programs like Gmer or AVG Anti-Rootkit. It is probably be best used in conjunction with these tools.

Check a system for rootkits with Gmer

Martin Brinkmann — Sun, 06 May 2007 17:18:00 +0000

Gmer is primary a free rootkit scanner which offers additional functionality such as offering an Intrusion Prevention System and a Firewall. The interface looks very user friendly but the settings, options and the results require at last basic knowledge of rootkits and other means of harming the system to apply and interpretate them in the correct way. Gmer does notify the user if it spots something suspicious and displays those results in red in the main window. The two screenshots below show two typical scan results after performing a scan of your computer with Gmer.

As I said earlier, running Gmer is really easy. Just start the application and click on the scan button. Gmer does scan the system automatically and displays the results in the main window. If you spot red entries you should try and search the Internet for clues about them. It is possible to kill processes, service and files by right-clicking an entry in the main window.

Next to scanning for Rootkits you can also scan for Autostart entries, check running processes, services and modules and activate the Intrusion Prevention System and the Firewall. Take a look at this nice Gmer tutorial which walks you through a basic process.

AVG Anti Rootkit free

Martin Brinkmann — Thu, 05 Apr 2007 08:46:31 +0000

Rootkits received a publicity boost with Sony’s rootkit infested CDs that was supposed to be some kind of copy protection. Since then rootkits have become an ever growing threat on the Internet in line with Viruses, Trojans, Phishing and Spam. The major problem with rootkits is that most users think that their virus scanner protects them from rootkits as well which is most of the time not the case. Rootkits are much harder to detect by normal means and software that can scan systems for rootkits should be used by inexperienced users to be able to detect at least the most common ones.

AVG Anti Rootkit is a free software that scans a computer for rootkits and removes them if one or more of those have been identified. The anti rootkit application can be used to either quickly scan the computer for possible rootkits and the other to make an in depth scan which takes longer but is more thorough. The in depth scan for Rootkits takes some time depending on the amount of files and size of your hard drives.

Update: AVG Anti-Rootkit Free has been discontinued in 2006. The program has been integrated into various AVG products including (in 2010) in AVG Anti-Virus Free, AVG Anti-Virus 2012 and AVG Internet Security 2012.

The free version of AVG Anti-Virus is available on the official AVG website. Just download and install it on your Windows system to protect the PC from malicious software and Internet based attacks.

Please note that the free version has limitations, including less frequent and prioritized updates, no email or telephone support, less interface and software customizations as well as no server support. The free product version may also only be used on home and non-commercial use systems.