6 Rootkit Detector Programs reviewed & compared: INTERESTING READ!

[Alec§taar]

Review: Six Rootkit Detectors Protect Your System:

http://www.informationweek.com/news...UNN2JVN?articleID=196901062&pgno=5&queryText=

• F-Secure BlackLight
• IceSword
• RKDetector
• Rootkit Buster
• Rootkit Revealer
• Rootkit Unhooker

* Interesting when you see the results, & which was the MOST effective as well!

APK

 

[Jimmy 2004]

Nice find, I'll look through it. I already use Sophos Rootkit scanner and Rootkit Revealer, but if any are better I'll take a look.

 

[Alec§taar]

Here, I keep this list of them around:

Sophos AntiRootkit
BitDefender AntiRootkit
FSecure Blacklight
McAfee AntiRootkit
Rootkit Buster
Rootkit Revealer
Rootkit Unhooker
GMER
Rootkit Hook Analyzer



* Some more of them that are NOT in the list tested above are in that list... they are 'bolded' for your references...

APK

 

[Sasqui]

Review: Six Rootkit Detectors Protect Your System:

http://www.informationweek.com/news...UNN2JVN?articleID=196901062&pgno=5&queryText=

• F-Secure BlackLight

• IceSword

• RKDetector

• Rootkit Buster

• Rootkit Revealer

• Rootkit Unhooker

* Interesting when you see the results, & which was the MOST effective as well!

APK

Cool find - Rootkit Unhooker 3.0 looks like it kicks butt.

 

[zekrahminator]

Rootkit buster found about seven things it couldn't delete, either nice job Trend Micro (sarcastic) or I need to format Windows.

 

[Jimmy 2004]

Rootkit buster found about seven things it couldn't delete, either nice job Trend Micro (sarcastic) or I need to format Windows.

Most of the things I used to find with rootkit revealer were nothing... the Vista Beta would create hidden files on my main drive, things like Daemon tools and Alcohol 120% create suspicious files to stay hidden. I'm going to do my scans tomorrow and see what I find.

 

[zekrahminator]

How interesting, I have sptd.sys detected as possible rootkit activity. Google dismisses it as a part of Daemon tools....when I've never installed it. I heard that it's also a part of Alcohol 120, which I DID use once. I want to just remove it, BUT it's in the Windows drivers folder, and if it's not a part of Daemon tools or a rootkit, it's required for Windows startup...ugh.

Suggestions?

 

[zekrahminator]

I booted into safemode and got rid of it myself, the two rootkit detectors I'm using detect nothing hooked by sptd.sys. It passed itself off as a SCSI driver in the drivers folder, chances are it was . But whatever, I'm not taking the chance of having a rootkit, and can't remember the last time I used a SCSI device anyways.

 

[Jimmy 2004]

I know how you feel - my PC sometimes has a problem booting if Daemon tools has an image mounted, and I could only boot into safemode. The only way to solve it was to get rid of sptd.sys and remove all traces of alcohol 120 and daemon tools. That wasn't fun, uninstallers don't work properly from safemode.

 

[Alec§taar]

How interesting, I have sptd.sys detected as possible rootkit activity. Google dismisses it as a part of Daemon tools....when I've never installed it. I heard that it's also a part of Alcohol 120, which I DID use once. I want to just remove it, BUT it's in the Windows drivers folder, and if it's not a part of Daemon tools or a rootkit, it's required for Windows startup...ugh.

Suggestions?

Yes...

Run Devmgmt.msc, & use its VIEW menu, Show Hidden devices submenu, & this will put a NEW item onto the device tree named "Non Plug and Play Devices"...

From there, USUALLY, you can disable various drivers that 3rd party tools might install, that you WON'T SEE in the device manager tree items listings.

APK

P.S.=> It ought to do the job, fairly easily, w/ 3rd party drivers that various programs install, & even for AntiRootkit tools (like GMER) that use specialized filtering drivers to do their job (but, just be SURE you don't cut off any needed ones while you're in there)... apk

 

[DRDNA]

Rootkits cab be nasty little buggers. I ran the Rootkitbuster one and found several hooks(all zone alarms[vsdatant.sys]) and also found several picture in two different formats .jpeg and .bmp .. These were pics that were unable to be viewed or even seen by an advanced search, however RootkitBuster found these files pretty fast , I did delete the images ..lol , pretty good find >>RootkitBuster=FREE fully functional download(legal)

Well I'm off to test some more of these ......Please any one who has never used one of these kind of apps "ALWAYS RESEARCH WHAT YOU DELETE BEFORE YOU DELETE THEM!!"

DO NOT DELETE THE FILES FOUND WITH THESE APPS UNTIL YOU HAVE RESEARCHED WHAT YOU ARE DELETING!!!!!

 

[Jimmy 2004]

DO NOT DELETE THE FILES FOUND WITH THESE APPS UNTIL YOU HAVE RESEARCHED WHAT YOU ARE DELETING!!!!!

Well, most of them find quite a few entries, but I've narrowed down all of them to being either AVG anti-spyware, Daemon Tools/Alcohol or reminants from when I had Vista on this system. Nothing needing deleting here

Plus, I had no viruses and no adware, which is nice. Then again, I never have it anymore.

 

[Steevo]

Rootkit unkooker always starts with a parasite warning, within itself, and the after a scan it detects nothing.



But after running a VM chaeck sometimes I get 117 or 134 then it drops to 14 or so.



I checked with VMware, and it shows that there is nothing running.


The only real worrysome thing was four files on my Vista installation in my temp folder that were only to be opened by another process. But I deleted them and there we no problems.