Well there isn't much more to add on how to determine rootkits using rootkitrevealer. The authors of rootkitrevealer provide an excellent tutorial on how to use the tool: http://www.sysinternals.com/Utilities/RootkitRevealer.html
But to keep things simple and succinct, here is a good tip on how to detect a rootkit regardless on how many discrepancies and unconfirmed false positives were found:
Most rootkits register themselves as services in the windows registry. Therefore a rootkit exists if rootkitreveler finds one or more of the following entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\xxxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\xxxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xxxx
where xxxx is an arbitrary service name given by the rootkit. So to make this clear, if you find any one of these entries in the rootkitrevealer results, then you have a rootkit. If you have none of these entries in your log then most likely you dont have a rootkit.
BEC Scammers Adventures on the Run
-
Last week the case of Valentine FOMBE was finally brought to a close. FOMBE
was sentenced to 144 months in Federal prison and ordered to pay $325,856
in...
5 weeks ago
No comments:
Post a Comment