Security Incidents mailing list archives
RE: Help, possible rootkit
From: k levinson <levinson_k () yahoo com>
Date: Mon, 25 Oct 2004 07:34:24 -0700 (PDT)
In addition to the other advice already given, if you're still interested in trying to confirm or deny whether this could be a root kit, even though RKDetect found nothing... Try scanning and inspecting the computer using the same tools you've used, as well as up to date anti-virus and looking at the startup values in the Registry... but instead of using them remotely, try using them across the network through Windows networking from another Windows computer, or after slaving the hard drive to another Windows system. [Booting to another OS such as a Knoppix or www.bitdefender.com CD to inspect the file system for new or unusual files might help as well, although those may not support detection of files hidden by ADS, and many of your Windows detection tools won't work.] Try also searching for files that have changed in the past day or three. There are programs that let you inspect the programs that start up with Windows, such as the MSCONFIG command, Silent Runners from www.silentrunners.org [looks in some places the others don't], Startup List, Startup Cop, etc. LADS from www.heysoft.de and ADSSpy will let you inspect files hidden by ADS. Note that Windows uses ADS for image thumbnails and XP SP2 AES zone information. But anything malicious would probably be easily overlooked amongst the many legitimate ADS files you're likely to find. I wonder whether you've run the command NETSTAT -ANO ? Inspecting your firewall logs or running Ethereal locally to look forfor unusual network traffic from your system might also be helpful in some circumstances. - karl levinson
--- BillyBob <billybobknob () hotmail com> wrote:I have noticed that my XP system is behaving like
I
have a rootkit.
Any more suggestions ? Any more rootkit finding tools for Windows ?
__________________________________ Do you Yahoo!? Yahoo! Mail - You care about security. So do we. http://promotions.yahoo.com/new_mail
Current thread:
- Help, possible rootkit BillyBob (Oct 24)
- Re: Help, possible rootkit Glenn Sieb (Oct 24)
- Re: Help, possible rootkit Harlan Carvey (Oct 24)
- Re: Help, possible rootkit Arias Hung (Oct 24)
- Re: Help, possible rootkit Marcus Merrin (Oct 24)
- RE: Help, possible rootkit Benjamin Tomhave (Oct 24)
- RE: Help, possible rootkit Leif Ericksen (Oct 25)
- <Possible follow-ups>
- Re: Help, possible rootkit Ralph W. Reid (Oct 24)
- RE: Help, possible rootkit Tony Langdon (ATC) (Oct 25)
- RE: Help, possible rootkit k levinson (Oct 25)
- RE: Help, possible rootkit Bowes, Ronald (EST) (Oct 25)