Trend Micro RootkitBuster 1.6.0.1055 Beta

[AshenSugar]

Publisher's Description:

Trend Micro RootkitBuster is a rootkit scanner that offers ability to scan for hidden files, registry entries, processes, drivers and hooked system service. It also includes the cleaning capability for hidden files and registry entries.

if you have xp and have used any sony music cd's in ur system, well u should run this

 

[Alec§taar]

if you have xp and have used any sony music cd's in ur system, well u should run this

Got a URL for download for this? I don't see one above...



* I keep & use these things. along w/ AntiVirus (Symantec Corp. Edition Client 10.2) & AntiSpyware (SpyBot, AdAware, Windows Defender latest) tools, every Sat. A.M. & that's coming up soon (tomorrow a.m.)... & I would like to have its "latest/greatest" around for that job!

(Thanks!)

APK

 

[oily_17]

Damned Sony CD's...Download below

http://www.neowin.net/index.php?act=view&id=37731

 

[Alec§taar]

Damned Sony CD's...Download below

http://www.neowin.net/index.php?act=view&id=37731

Thanks Oily... that's newer than the version I was using (v1049)!



* Cool, & now for my Sat. A.M. AntiVirus/AntiSpyware/AntiRootkit scan tomorrow a.m., I am 'fully armed & up-to-date'...

APK

 

[AshenSugar]

fod av i prefer f-prot6 or nod32, bouth KILL norton on ram and cpu use, ZERO system perf hit even on older systems
f-prot works on even OLD systems without hurting windows perf(it uses around 12mb ram MAX avrage 4mb)

norton, well it hasnt been re-writen in years, since they bought out IBM antivirus and copyed its code all they have really done was update and tweak it, make the gui diffrent, the problem with this is that each time they update/tweak it they make it use more ram and more cpu, i hate poor coding.

also hate that so many viruses can easly dissable norton/mcafee when they cant seem to dissable f-prot,nod32 or a couple others i have used(panda for example)

 

[Alec§taar]

fod av i prefer f-prot6 or nod32, bouth KILL norton on ram and cpu use, ZERO system perf hit even on older systems
f-prot works on even OLD systems without hurting windows perf(it uses around 12mb ram MAX avrage 4mb)

One day, I am going to have to try this NOD32 you guys all "rave" about here... I haven't to date, but it's THAT kind of review by others that makes me try other wares.

PerfectDisk & VLC being yet others folks HERE, have turned me onto trying for the first time, OR again, & I switched (it happens!)

norton, well it hasnt been re-writen in years, since they bought out IBM antivirus and copyed its code

Yea, the 'base engine' in its services &/or drivers probably is the same as it has been since, I'd wager, around 2000... admittedly, you're probably correct. BUT, it's interface/usermode code is new, 'dumbed-down' & slower, no questions asked & WHY I stick by Corporate Client model.

ALSO:

Don't mean to be a dork, but do you have "backing substantiation" of that claim it's IBM AntiVirus originally? If so, I'd like it... just for my own knowledgebase here (yes, I actually keep data like that, it interests me where softwares originate from & all that).

Thanks...

all they have really done was update and tweak it, make the gui diffrent, the problem with this is that each time they update/tweak it they make it use more ram and more cpu, i hate poor coding.

Sometimes, updates are 'downdates', & this isn't the only ware that has undergone that, @ least for the version MOST FOLKS use that is...

ATI doing its Catalyst (tuning options, not driver stuff or services) series via .NET is one I felt took a 'downturn':

See, I feel .NET code is great, doing server-side ASP.NET stuff, hands-down it rules there (faster than std. ASP, & has garbage cleanup like Java, etc.), but VB.NET or even C# is just not as quick as say, Pure C/C++, Delphi (both of these latter 3 ROCK, & especially if you embed Win32 direct API calls &/or Assembler code inline), or even other VB6 interpreted code (especially if you embed Win32 direct API calls here), but it is a LOT safer in many ways.

Anyhow - I use the "Corporate Edition 10.2 Client" & it's pretty solid & bugfree/invulnerable @ this point, or last I knew of @ least... I haven't checked in awhile, but if you can point me to some? I might think of work-arounds for it, as I did below:

E.G.-> The vulnerabilities 10.1 had, I countered for in the registry anyhow via bufferoverflow hacking & service privelege lowering per services that CAN be run, less than SYSTEM entity levels of privelege & many of Norton's can, & run fine... & I did that for years now, because it works, & I figured it was going to happen that services would be attacked, eventually.

Also, it's interface? Is like the FAR LIGHTER/less wizardy 2001 NAV edition, what is FAR DIFFERENT than most folks use @ home today...

also hate that so many viruses can easly dissable norton/mcafee when they cant seem to dissable f-prot,nod32 or a couple others i have used(panda for example)

They don't disable 10.2 corporate that I know of, @ least not by the methods I shut off since way back, regarding buffer-overflow hacking of its usermode components, to access service level process priveleges.

BUT, I'd concede it IS targetted by a great many malware/spyware/virus/rootkit authors, etc. et al, by all means... mainly, because it's popular!

APK

 

[AshenSugar]

i will look for the info about nav and ibmav again, the site may not be up anymore tho, but what happened was that OLD norton(dos based with windows "gui") coudnt run properly under nt based os's ibm av could run on win9x and nt no problem, also it was faster and more powerfull per its size(2 floppys for install 1 for the rescue disk) and had native windows gui.
norton needed a new core av, ibm was looking to sell off ibmav because they where tired of supporting it, norton bought it, then changed the GUI and name and used that(the sigs where the same and ibmav could get updates that where for nav in those days) since then they havent fully redesigned the core, they just modifyed it here and there, adding stuff mostly.

the problem with that is the fact that every other major av maker other then mcafee has re-writen their cores a few times since then, mcafee is ok for keeping stuff off ur system, but if anything gets on, well u need another companys rescue disk to remove it(this from alot of personal exp) they bouth use ALOT more resorces then nod32 or f-prot/f-secure, be it on a server of desktop system.

f-prot has re-writen its windws client a few times, tho 3.x held for years without being fully rewriten, 6 is a new core and gui tho it uses the same sig files(so they can easly update ALL versions, u can get f-prot for dos free, very handy for system recoverys )

for another rootkit buster try blackice rookit tool( i acctualy like it better then trend)

trend micros stuff is good, i like their av, tho its not as good as nod32 or f-prot in my exp, it isnt neerly as system heavy as nav or mcafee.

 

[Completely Bonkers]

I left Norton after moving to Win 2000. While it was the king if Windows 95/98... Norton screwed up SO MANY 2000/XP systems that I am very hesitant to use their products again. (Unless gun or other nasty device pointing at head).

 

[Deleted member 24505]

nod32 seems to work ok on vista too ashensugar.

 

[Alec§taar]

nod32 seems to work ok on vista too ashensugar.

Aha, yet another one: I know AVAST does, & Microsoft "OneCare Live" as well!



* Good to know!

APK

 

[AshenSugar]

http://www.f-prot.com/
u can try f-prot from there for 30days free, its like 25-30bucks for home licenc(works on any windows version even server 2003) for up to 5 pc's per licence, tho if you have more in your home they arent gonna get upset if they all share the same update code.

for nod32, send me an email i have it in my gmail for quick share

 

[AshenSugar]

Aha, yet another one: I know AVAST does, & Microsoft "OneCare Live" as well!



* Good to know!

APK

ms's dosnt past vb100% even tho they tryed to say it did, ms is now having to pay fines for using the symbol.

f-prot and nod32 bouth pass

 

[Alcpone]

For me I use F-Secure AV 2006, got it free for 2 years through bank account!

I use e-trust pest patrol for spyware, etc!

 

[Alec§taar]

i will look for the info about nav and ibmav again, the site may not be up anymore tho, but what happened was that OLD norton(dos based with windows "gui") coudnt run properly under nt based os's ibm av could run on win9x and nt no problem, also it was faster and more powerfull per its size(2 floppys for install 1 for the rescue disk) and had native windows gui. norton needed a new core av, ibm was looking to sell off ibmav because they where tired of supporting it, norton bought it, then changed the GUI and name and used that(the sigs where the same and ibmav could get updates that where for nav in those days) since then they havent fully redesigned the core, they just modifyed it here and there, adding stuff mostly.

I believe you, but I keep this stuff for various things as proofs etc. & IF you can find that URL? That would be COOL!

the problem with that is the fact that every other major av maker other then mcafee has re-writen their cores a few times since then, mcafee is ok for keeping stuff off ur system, but if anything gets on, well u need another companys rescue disk to remove it(this from alot of personal exp) they bouth use ALOT more resorces then nod32 or f-prot/f-secure, be it on a server of desktop system. f-prot has re-writen its windws client a few times, tho 3.x held for years without being fully rewriten, 6 is a new core and gui tho it uses the same sig files(so they can easly update ALL versions, u can get f-prot for dos free, very handy for system recoverys )

It's possible... but, they tend to do well in tests, so, I stick by Norton CORPORATE... it lighter/faster than the std. model most folks use @ home (since 2003 model, iirc, when it really changed/dumbed-down/got wizardy & webpage looking in usercode end).

for another rootkit buster try blackice rookit tool( i acctualy like it better then trend)

Got it, along with:

• AVG AntiRootkit

• BitDefender AntiRootkit

• GMER

• Rootkit Revealer

• PrevX AntiRootkit

• Rootkit Hook Analyzer

• Sophos AntiRootkit

Why so many (8 total) of THIS kind of program? Because imo, this is the biggest threat out there today... ROOTKITS!

trend micros stuff is good, i like their av, tho its not as good as nod32 or f-prot in my exp, it isnt neerly as system heavy as nav or mcafee.

It's decent I suppose, but I saw it fail (probably due to its setup) in corporate environs, it was NOT updating client ends from server end, & I turned up a keylogging type infection, that was on my machine, from the day I got it (& I didn't set it up either)...

That tells me it is difficult to setup for networked environs, or my former NETWORK ENGINEERING MGR. didn't know what he was doing (latter is pretty possible, he was more "hardware oriented" imo).

APK

 

[AshenSugar]

spyware/addware=webroot spysweeper, best antispyware program i have ever found, kicks addaware arse, and unlike adaware its never fucked up my systems internet connection!!!!(adaware removed some stuff that made my network nolonger work, ended up having to reinstall to fix it )

 

[AshenSugar]

yeah alec i know the feelingk, i have had to go into places and fix setups where the admin/it manager didnt know what they where doing when setting up software/hardware worst was spending 2 weeks reinstalling/setting up a companys av setup because the guy setup mcafee server+clients and it wasnt updating properly it was only updating macro virus sigs.

the company owner went with f-prot and i setup server/workstation versions so that the server downloaded the sigs to a folder(updating itself along the way) then the workstations checked that folder for updates 2x a day, very easy to setup.

trend is a bit more work, but not much, alot of it is doing it right the FIRST TIME, insted of fucking it up and trying to fix it aferword

 

[Scavar]

Hey I was wondering if someone, Ashen or Alec specifically hehe could make a list for me with some links to just general protection stuff.

I use to just use BitDefender and Spybot, but BitDefender is really pissing me off(It had a bunch of problems with a few games, and a couple of other annoyances)

Thanks a bunch, you guys are great.

 

[Mussels]

Nod32 (antivirus)
Xoftspy (Antispyware - have seen ONE false positive under vista RC2 - careful on that)
SPywareblaster (blocks known bad sites from IE/FFox)

I use these three and never have any issues on any of my systems.

 

[Wile E]

I'm gonna ring in with Kaspersky for anti-vir again. Great proggy, right up there with NOD32 in terms of security. I tried NOD32 and liked it, but I just like the features and UI of Kaspersky better. It's more intuitive for me (that's purely personal, of course) and also highly configurable.

I also use Spyware Doctor for my anti-spy, ranks second next to Webroot Spysweeper. Got 2yrs for free tho, so I can't complain. I'll probably switch to Spysweeper when this is up tho(Unless, of course, something better comes along).

 

[Alec§taar]

Hey I was wondering if someone, Ashen or Alec specifically hehe could make a list for me with some links to just general protection stuff.

I use to just use BitDefender and Spybot, but BitDefender is really pissing me off(It had a bunch of problems with a few games, and a couple of other annoyances)

Thanks a bunch, you guys are great.

Here is a list of programs I use:

AntiRootkit (from above)

AVG AntiRootkit
BitDefender AntiRootkit
GMER
Rootkit Revealer
PrevX AntiRootkit
Rootkit Hook Analyzer
Sophos AntiRootkit

AntiVirus

I use Norton Corporate Edition version 10.2

AntiSpyware

AdAware latest
SpyBot latest

(They're a decent list of 3rd party wares I use for scanning & patrolling for virus/malware/spyware/trojans etc. et al)

Native GUI tools can be immensely helpful too though... stuff like:

SCW (security configuration wizard) - Windows Server 2003 only afaik
msconfig.exe (for analyzing startup groups & registry run areas, + .ini files)
regedit.exe (for altering ACL's on registry hives/keys for security purposes)
explorer.exe (for altering ACL's on folders-directories/files on NTFS for security purposes)
services.msc (for altering ACL's on service logon entities assigned to less than SYSTEM, if & when possible (not all can do this) for security purposes)
secpol.msc (for stepping up the default security level on various items in its tree lists)
gpedit.msc (" same as secpol.msc ")
lusrmgr.msc (" same as secpol.msc ")
eventvwr.msc (to view the results of changes I made, & fix any errs that MAY occur in the OS, services, or apps from said changes mentioned above)
Windows native firewal (or, other ones that are better in that they report outgoing transmissions too, not just incoming ones)

To use those tools though, & imo, that's ONLY a start in that tiny list of the ones native to the OS, you need to understand a few things WELL imo, first:

I.E.-> What REALLY can help you though, is first understanding the registry & NTFS filesystem, & then applying the correct users allowed to access either (ACL alteration via rightclick permissions stuff) & services securing, as well as trimming off ones you do NOT need to be running, & far more...

Then, understanding things like how IP works, for helping stall invaders into your system that way, via hacks/cracks/remotely accessible vulnerabilities in the OS, & applications on it (that use the web)... things in your webbrowsers, email programs, etc. & understanding ow ActiveX/OLE/DCOM/COM+ & Java/JavaScript - ActiveScript work, & how to stall those potential remote threats as well via hardware AND software combined.

(If you don't understand ALL of that stuff well enough, well, my advice is to STEER CLEAR of playing w/ that which you do not!)

See, until you do, some of that stuff (ACL stuff especially, access control lists, & NTFS + registry hive/key user rights) can be 'dangerous' in that you can lock yourself out of your rig, or lose functionality (e.g.-> I literally ran Windows Server 2003 earlier this a.m. with NO SERVICES RUNNING @ ALL, because of it, but, could not get online, hear sound in games or otherwise, but it sure was interesting AND FAST TOO)...

However, the only way to get to really understanding those tools, is experience & experimentation using them (especially NTFS & Registry rights imo)!

See - once you get it down though? You can TRULY get more secure both online & locally vs. dangers out there now (imo @ least!)



* ALSO/of course - Staying ontop of OS & application patches &/or updates, another good thing to practice.

APK

P.S.=> Perfectly safe, I don't know IF that is possible, BUT, I know that "safer", is!

Then, @ that point, I figure the rest is up to you, & your user habits really... being smart (the usual -> don't open email attachments from strangers, etc. type stuff)... apk

 

[AshenSugar]

I'm gonna ring in with Kaspersky for anti-vir again. Great proggy, right up there with NOD32 in terms of security. I tried NOD32 and liked it, but I just like the features and UI of Kaspersky better. It's more intuitive for me (that's purely personal, of course) and also highly configurable.

I also use Spyware Doctor for my anti-spy, ranks second next to Webroot Spysweeper. Got 2yrs for free tho, so I can't complain. I'll probably switch to Spysweeper when this is up tho(Unless, of course, something better comes along).

kasp is ok, i have used it, but its as resorce heavy as norton, and thats not a good thing, i like my tools to be light and fast, not causing any kind of performance impact.

Hey I was wondering if someone, Ashen or Alec specifically hehe could make a list for me with some links to just general protection stuff.

I use to just use BitDefender and Spybot, but BitDefender is really pissing me off(It had a bunch of problems with a few games, and a couple of other annoyances)

Thanks a bunch, you guys are great.

spyware: webroot spy sweeper+spybot search and destroy, spysweeper kicks adaware arse, yes u gotta buy it, but it is by far the better choice, it finds stuff bouth spybot and adaware miss, tho adawares never found anything spybot+spysweeper have missed in my exp.

av, nod32 or f-prot, eather is a good choice in my exp, they work on ANY windows version(currently useable ver anyway server or workstation) and have close to zero perf impact even on my OLD laptop(p233mmz 208mb ram) and nothings gotten by them yet and i dont exectly surf the safist sites.

if you want/need a 3rd part firewall, theres only one i currently am willing to reccomend to buy and its not just a firewall anymore.
blackice protection, once you have this setup its pretty much fool proof for stoping unwanted apps from getting internet access, and its very good at tracking and blocking atacks, its not free but its worth getting if you have secuiry concerns, i just use the firewall portion, tho its also got app security keeping unwanted apps from being able to start/run(asks if u want them to run)

i use to use sygate personal/pro for a firewall but they sold out as did kerio from what i reammber, the only other firewall i have had good luck with is tiny, and its last ver i tested was a bit buggy(may have been abeta cant remmber)


also a good app to have is windowwasher, it is VERY good for long run systems, can clean out GIGS of crap, i got back 36gb on a system recently by running it, no joke, the system was a winxp rig(no sp, EARLY xp rig) it was VERY slow and VERY VERY full of crap, after washing and removing spyware and then running a perfect disk boottime defrag the system was like a whole diffrent rig, faster and more responcive, and wasnt low on hdd space anymore.

some apps are worth buying, and windowswasher+spysweeper are for sure worth it, best in class apps!!!!
BlackIce Protection is the only firewall/app protection app i can reccomend anymore really, its quility is unsurpassed, and once your use to its gui(layout takes a few min to get use to) you will find its easy to use and VERY robust, infact i know of a few companys that use it on their secure servers(ones a bank)

watch it with adaware, never delete the backups you may need to restore something if adaware removes something that kills ur net connection(happened to me(5t times) and clients of mine more then once)

tryed ultimet defrag, i gotta say im VERY impressed, now using it in cunjunction with perfect disk(perfects faster on drives that are quite full)

 

[Wile E]

kasp is ok, i have used it, but its as resorce heavy as norton, and thats not a good thing, i like my tools to be light and fast, not causing any kind of performance impact.

I couldn't disagree more. Although it uses more resources than NOD32, it is nowhere nears the hog that Norton is. If I can remember where I saw the article I'll post a link, but in the test, Norton cause a 14-16% performance loss in benchmarks, McAfee = 11-13%, Kaspersky = 8-10% and NOD32 = 5-7%, if memory serves me correctly. I'm googling for confirmation right now.

 

[Alec§taar]

I couldn't disagree more. Although it uses more resources than NOD32, it is nowhere nears the hog that Norton is. If I can remember where I saw the article I'll post a link, but in the test, Norton cause a 14-16% performance loss in benchmarks, McAfee = 11-13%, Kaspersky = 8-10% and NOD32 = 5-7%, if memory serves me correctly. I'm googling for confirmation right now.

Ah, I hope you CAN turn that up: Because THAT's the type of information, via legit comparisons done in reviews, that often make me try NEW softwares for a particular purpose, vs. the ones I use now... in this case, AntiVirus programs.

Resource usage on this NOD32 sounds great, but the MOST important part, imo @ least, is how well they do @ finding & killing virus' themselves though...

I get a lot of "the good word" on this NOD32 program from you guys, & yes, word-of-mouth is important, but seeing a formal test, run right? Does the job for me, & puts the "icing on the cake" so-to-speak, for me to move from one ware for a particular job, to another.

It happens: Diskeeper -> PerfectDisk, WinZip -> WinRar, IE/FireFox -> Opera, Windows Media Player -> VLC... list goes on, but those are MY recent "conversions" the past few years now... due to all of the above (folks word, & tests I have seen run comparing them).

APK

 

[AshenSugar]

alec read vb100% reviews, nod32 has gotten the most vb100% awards ever

 

[Wile E]

Well I'm still loooking for the performance tests, but in the meantime I found what seems to be a good site on AV effectiveness. http://www.av-comparatives.org/