Full Disclosure mailing list archives
suspicion of rootkit
From: phocean <0x90 () phocean net>
Date: Wed, 11 Jul 2012 22:42:42 +0200
Hi list, I am having a strange issue. I have a lab virtual machine that behaves as if it was owned by a rootkit: weird behavior with system certificates and keyboard driver. I first thought that with this knowledge it would be easy to spot the culprit: find some malicious driver or some kernel hook. But I failed... The problem is I have tried both live and RAM analysis (Volatility) and found absolutely nothing unusual. I am not an expert of Windows internals, so I am probably missing something. Could you please give me some hint or point me to some resource? (I have the book Windows Internals, but still I don't see how to start with this mess). More details are on my blog. Thanks, --- phocean
Attachment:
signature.asc
Description: Message signed with OpenPGP using GPGMail
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- suspicion of rootkit phocean (Jul 11)
- Re: suspicion of rootkit valdis . kletnieks (Jul 11)
- Re: suspicion of rootkit phocean (Jul 11)
- Re: suspicion of rootkit Alexandru Balan (Jul 11)
- Re: suspicion of rootkit phocean (Jul 11)
- Re: suspicion of rootkit valdis . kletnieks (Jul 11)