RE: Question: Need Suggestions (sorry)

["y0himba" <y0himba () technolounge org>]

Actually I am just needing something to log all processes starting and
stopping on the system.  That way I can capture whatever it is that is
starting/stopping so fast and find out if it is legit.  So far it does it
when I run Counterstrike:Source, Skype, When Trillian first starts loading,
and occasionally it will just run when I have nothing on the system running,
and my Internet connection is disabled, it may be related to the latest
"patch Tuesday"...   

-----Original Message-----
From: Dave Alanis [mailto:SDALAN04 () smumn edu] 
Sent: Monday, April 17, 2006 8:10 PM
To: y0himba; full-disclosure () lists grok org uk
Subject: re: [Full-disclosure] Question: Need Suggestions (sorry)

Sorry for the redundant information I just posted. I meant to say rootkitty:

RootKitty is a very simple utility that makes a file listing when running
from windows and a file listing from PE/ubcd4win then compares the two files
and shows you the differences (looking for rootkits).

This is exactly what RootKitty does.

RootKitty only scan for files right now although I might add registry
scanning sometime soon.


Note: there will be some false positives. Also, this does not detect stealth
software that hides in BIOS, Video card EEPROM, disk bad sectors, Alternate
Data Streams, etc.


The same goes for RootKitty so don't just delete anything that it finds!

Here's the link:

http://EzPcFix.net/dload/RootKitty.exe

Here's how to use it:

1. Boot into windows and click on "Win-Scan". The mouse pointer will turn
into an hourglass and a dos box will open. You have to wait until the dos
box disappears and the mouse pointer goes back to normal before closing the
program. This can take quite a while if you have alot of files.
2. Boot into ubcd4win and click on "PE-Scan" and wait for it to finish 3.
Click on "Compare"

If a file was detected in PE/ubcd4win and was stealthed from windows then
it'll show up in the listbox.



"Great Spirits Have Always Encountered Violent Opposition From Mediocre
Minds" - Einstein

"Cuanta estupidez en tan poco cerebro!"


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/