RKDetect - behaviour based rootkit detection utility
Quote:
Rkdetect is a little anomaly detection tool which can find services hidden by generic Windows rootkits like Hacker Defender. Tool very simply. It enumerates services on remote computer through WMI (user level) and Services Control Manager (kernel level), compare result and display difference. In this way we can find hidden services which usual used to start rootkit. Similar approach can be used to enumerate processes, files, registry keys and anything that rootkits can to hide
http://www.security.nnov.ru/search/news.asp?binid=3682
http://www.security.nnov.ru/search/d...asp?docid=6198
