RootkitRevealer
RootkitRevealer is an advanced rootkit detection utility. RootkitRevealer successfully detects many persistent rootkits including AFX, Vanquish and HackerDefender.
How Does RootkitRevealer Works?
Since persistent rootkits work by changing API results so that a system view using APIs differs from the actual view in storage, RootkitRevealer compares the results of a system scan at the highest level with that at the lowest level. The highest level is the Windows API and the lowest level is the raw contents of a file system volume or Registry hive (a hive file is the Registry's on-disk storage format). Thus, rootkits, whether user mode or kernel mode, that manipulate the Windows API or native API to remove their presence from a directory listing, for example, will be seen by RootkitRevealer as a discrepancy between the information returned by the Windows API and that seen in the raw scan of a FAT or NTFS volume's file system
structures.
The main features of RootkitRevealer are:
1. Analyze and display the hidden processes
2. Very useful for finding rootkits
3. Safe, stable, fast and very effective
4. Simple and intuitive interface
5. RootkitRevealer is an application difficult to use
6. Manual Update
RootkitRevealer is an advanced rootkit detection utility. RootkitRevealer successfully detects many persistent rootkits including AFX, Vanquish and HackerDefender.
How Does RootkitRevealer Works?
Since persistent rootkits work by changing API results so that a system view using APIs differs from the actual view in storage, RootkitRevealer compares the results of a system scan at the highest level with that at the lowest level. The highest level is the Windows API and the lowest level is the raw contents of a file system volume or Registry hive (a hive file is the Registry's on-disk storage format). Thus, rootkits, whether user mode or kernel mode, that manipulate the Windows API or native API to remove their presence from a directory listing, for example, will be seen by RootkitRevealer as a discrepancy between the information returned by the Windows API and that seen in the raw scan of a FAT or NTFS volume's file system
structures.
The main features of RootkitRevealer are:
1. Analyze and display the hidden processes
2. Very useful for finding rootkits
3. Safe, stable, fast and very effective
4. Simple and intuitive interface
5. RootkitRevealer is an application difficult to use
6. Manual Update
0 comments:
Post a Comment