Rootkits: What's a newbie to know?
Results 1 to 8 of 8

Thread: Rootkits: What's a newbie to know?

  1. #1
    Junior Member
    Join Date
    Apr 2006
    Posts
    3

    Rootkits: What's a newbie to know?

    Can anyone recommend some rootkit info/detectors to use for someone that isn't all that computer security literate? So far I've been using Rootkit Revealer and RKDetector. But, as I've read, how trustworthy are these programs on systems that may have already been compromised? I've posted RKR logs to their corresponding forums and they said I was fine. With RKD, however, I keep getting results on my System Volume Info folders, namely in restore. Regardless, I'm reinstalling my OS (XP).

    I keep reading about rootkits being the next big thing in computer security and I just want to be able to protect myself accordingly since I've made an enemy of sorts in the past few months with someone a lot more computer literate, especially in computer security, than me.

  2. #2
    StOrM™
    Join Date
    Aug 2004
    Posts
    1,003
    Greeting's

    Here are some source's of information :

    1. http://research.microsoft.com/rootkit/

    2. www.rootkit.com

    3. http://www.amazon.com/gp/product/032...20749?n=283155 (its a link to a nice book)

    Finally you may try GOOGLE. (I got the results from there only and from systeminternals.com)


    You must understand that to install a rootkit your computer's security will be compromised, hece what I want to say is you must start from basics like firewall, anti-virus, local-user policy, deleting or disabling un-needed service's etc. You shouldnt worry much about rootkit but you should worry about other security aspects.
    Parth Maniar,
    CISSP, CISM, CISA, SSCP

    *Thank you GOD*

    Greater the Difficulty, SWEETER the Victory.

    Believe in yourself.

  3. #3

  4. #4
    Dissident 4dm1n brokencrow's Avatar
    Join Date
    Feb 2004
    Location
    Shawnee country
    Posts
    1,243
    I've used Rootkitrevealer quite a bit. It'll generate a lot of false positives. I ran it on my old NT webserver and EVERYTHING in the Apache folder came up positive. That was rather an exception. Better be ready to google any files it finds.

    Don't know about the others. Falcon, thanks for the link to RootKit Hook Analyzer.
    “Everybody is ignorant, only on different subjects.” — Will Rogers

  5. #5
    Junior Member
    Join Date
    Apr 2006
    Posts
    20
    SysInternals is a great place to start:

    http://www.sysinternals.com/Utilitie...tRevealer.html

    There are several referenced sites at the bottom that this site is based on.

  6. #6
    oldie ric-o's Avatar
    Join Date
    Nov 2002
    Posts
    487

    Re: Rootkits: What's a newbie to know?

    Originally posted here by invalidant
    I keep reading about rootkits being the next big thing in computer security and I just want to be able to protect myself accordingly since I've made an enemy of sorts in the past few months with someone a lot more computer literate, especially in computer security, than me.
    Just make sure they dont have physical access to your PC...if they do there's very little you can do to keep them from planting something on there.

    Otherwise just make sure you practice the basics (assuming you are running Windows)...

    * Updated anti-virus installed
    * Updated anti-spyware apps installed (recommend more than 1)
    * Personall firewall installed
    * Surf Internet and read email while logged in as a non-administrator user
    * Set web browser to block pop-ups and not run Java or Javascript
    * Dont click links in emails

    This should help keep you safe. Remember though: no physical access for this person!

  7. #7
    Junior Member
    Join Date
    Oct 2005
    Posts
    18
    How is chkrootkit as a rootkit detector?
    Cereal: Eaten at all times of the day.

  8. #8
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,191
    wheaty_bytes

    AFAIK chkrootkit is for *nix and the OP is using Windows XP?

    All I would suggest is that for something as sneaky as a rootkit you should certainly run your tests/scans in safe mode and I would personally prefer to run them from a live CD (or recovery CD) with trusted files on it, rather than those in the installed operating system that might have been already compromised by the rootkit.

    Just my £0.02

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •