Well there isn't much more to add on how to determine rootkits using rootkitrevealer. The authors of rootkitrevealer provide an excellent tutorial on how to use the tool: http://www.sysinternals.com/Utilities/RootkitRevealer.html
But to keep things simple and succinct, here is a good tip on how to detect a rootkit regardless on how many discrepancies and unconfirmed false positives were found:
Most rootkits register themselves as services in the windows registry. Therefore a rootkit exists if rootkitreveler finds one or more of the following entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\xxxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\xxxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xxxx
where xxxx is an arbitrary service name given by the rootkit. So to make this clear, if you find any one of these entries in the rootkitrevealer results, then you have a rootkit. If you have none of these entries in your log then most likely you dont have a rootkit.
Our APWG eCrimes Paper on Tech Support Scam Facebook Groups
-
My colleague Raghavendra Cherupalli will be at APWG eCrime next month
sharing a paper based on our research into the Facebook Groups where
illicit Indian...
1 week ago
No comments:
Post a Comment