rootkits finding the hidden processes??

xtheblack9x · Post by **xtheblack9x** » 17 Jan 2006, 04:46

any good programs that can find the hidden processes that are hidden with root kits?

Post by **bad_brain** » 17 Jan 2006, 05:37

for Windows use Rootkit Revealer, you can get it in the useful programs-downloads. for *nix systems use chkrootkit, you can get a RH9-RPM in the Unix/Linux-downloads, source files or RPMs for other distros can be found here: http://www.chkrootkit.org or here: http://www.rpmseek.com

xtheblack9x · Post by **xtheblack9x** » 18 Jan 2006, 00:31

thanks a million

Post by **Stavros** » 31 Jan 2006, 15:03

Thread revival! Ok, what do I do after I scan with RootkitRevealer and I get some hits?

Post by **bad_brain** » 01 Feb 2006, 06:18

well, depends on what has been found. not everything has to be a rootkit, some normal processes hook up on other ones too. google for the results and/or post what has been found...

rootkits are more used on servers than on normal user boxes, and to install one the system has to be compromised first, it´s not possible to install a rootkit on a box by sending it as an attachment for example like it´s done with the usual malware like trojans.