NTRootkit

[zero <zeroboy () arrakis es>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all,
          I was wondering, if NTRootkit hooks syscalls, many of the current
programs used to detect running procs and hidden keys in register will
fail. So, how could you actually detect if syscalls have been hooked? I
belive you could see if new native calls have been added, but how can you
detect hooked and modified native calls?

Thxs in advance

www.citfi.org
www.podergeek.com
**********************************
"The further backward you look, the further forward you can see" Winston 
Churchill
"Access is GOD..."

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>

iQA/AwUBPvHnQw0R8jZM93x8EQIW+gCcCQc/N5j4wq6yjAiZi0bQsKYVMegAoI90
F2Zp7FOM8O0q3EeZHFLj7Rv6
=r6/w
-----END PGP SIGNATURE-----


---------------------------------------------------------------------------
Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts!
The Gartner Group just put Neoteris in the top of its Magic Quadrant,
while InStat has confirmed Neoteris as the leader in marketshare.
     
Find out why, and see how you can get plug-n-play secure remote access in
about an hour, with no client, server changes, or ongoing maintenance.
          
Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
----------------------------------------------------------------------------