RootkitRevealer 1.71
RootkitRevealer is an advanced root kit detection utility.
|
0.00 
Freeware
0K
Windows XP/Vista 
RootkitRevealer is an advanced root kit detection utility. It runs on Windows NT 4 and higher and its output lists Registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit.
RootkitRevealer can successfully detect all persistent rootkits published at www.rootkit.com, including Vanquish, AFX and HackerDefender (note: RootkitRevealer is not intended to detect rootkits like Fu that don't attempt to hide their files or registry keys).
The term rootkit is used to describe the mechanisms and techniques whereby malware, including viruses, spyware, and trojans, attempt to hide their presence from spyware blockers, antivirus, and system management utilities. There are several rootkit classifications depending on whether the malware survives reboot and whether it executes in user mode or kernel mode.
Persistent Rootkits
A persistent rootkit is one associated with malware that activates each time the system boots. Because such malware contain code that must be executed automatically each system start or when a user logs in, they must store code in a persistent store, such as the Registry or file system, and configure a method by which the code executes without user intervention.
Memory-Based Rootkits
Memory-based rootkits are malware that has no persistent code and therefore does not survive a reboot.
User-mode Rootkits
There are many methods by which rootkits attempt to evade detection. For example, a user-mode rootkit might intercept all calls to the Windows FindFirstFile/FindNextFile APIs, which are used by file system exploration utilities, including Explorer and the command prompt to enumerate the contents of file system directories. When an application performs a directory listing that would otherwise return results that contain entries identifying the files associated with the rootkit, the rootkit intercepts and modifies the output to remove the entries.
The Windows native API serves as the interface between user-mode clients and kernel-mode services and more sophisticated user-mode rootkits intercept file system, Registry, and process enumeration functions of the Native API. This prevents their detection by scanners that compare the results of a Windows API enumeration with that returned by a native API enumeration.
Kernel-mode Rootkits
Kernel-mode rootkits can be even more powerful since, not only can they intercept the native API in kernel-mode, but they can also directly manipulate kernel-mode data structures. A common technique for hiding the presence of a malware process is to remove the process from the kernel's list of active processes. Since process management APIs rely on the contents of the list, the malware process will not display in process management tools like Task Manager or Process Explorer.
tags
kernel mode user mode file system mode rootkits native api the rootkit remove the the windows the contents api enumeration process management malware process the native
Download RootkitRevealer 1.71
Similar software
RootkitRevealer 1.71
Sysinternals
RootkitRevealer is an advanced root kit detection utility.
Panda Anti-Rootkit 1.05.00
Panda Software
Panda Anti-Rootkit is a small application that will use the latest generation technology to detect and remove rootkits on your system.
RootKit Hook Analyzer 3.01
Resplendence Software Projects Sp
RootKit Hook Analyzer is a security utility which will check if there are any rootkits installed on your PC which hook the kernel system services.
System Safety Monitor Free Edition 2.0.8.582
System Safety
System Safety Monitor (SSM) is a Host Based Intrusion Prevention System which protects your system from all known and unknown malware, rootkits and "zero-day" attacks.
F-Secure BlackLight Rootkit Detection 2.2.1061 Beta
F-Secure Corporation
Did you know that it is possible to hide spyware or a virus in a way that will fool even the traditional antivirus products?
Some spyware programs are already using so-called rootkits to hide deep in the system.
McAfee Rootkit Detective 1.0 Beta
McAfee Avert Labs
McAfee Rootkit Detective Beta is a program designed and developed by McAfee Avert Labs to proactively detect and clean rootkits that are running on the system.
AppDefend 1.0
Ghost Security
AppDefend is a kernel based software protection system, designed to be secure whilst using few resources.
ProSecurity 1.41
ISecSoft Inc
ProSecurity is a type of security application tool known as H.
Amust 1-Defender 2.0
AMUST Software
Amust 1-Defender is a free and powerful security utility for safe Internet browsing.
Ashampoo AntiSpyWare 1.60
ashampoo GmbH & Co. KG
Ashampoo AntiSpyWare can monitor and protect your computer continuously.
RSS