Vuln Dev
Re: Tool Release: ProcL - Detect Hidden Process Aug 01 2008 07:10AM
Pallav Khandhar (nightrover gmail com)
Greetings,

I am glad to release ProcL v1.0. ProcL employs many different methods
to detect hidden processes. Essentially, ProcL detailed and
implemented a mechanism to embed all these different approaches in one
tool to detect hidden processes. Our methods of detecting hidden
processes requires the examination of each kernel object - EPROCESS,
ETHREADS, HANDLES, JOBS. Therefore, we believe, ProcL would defeat
process concealment from one certain method.

Hiding a process is particularly threatening because it represents
some malicious code running on your system that you are completely
unaware of. Process hiding has a significant effect. Many of the
trojan, virus, spyware, rootkit writers use similar techniques to hide
themselves and stay undetected as long as possible on target machines.
Finding all the ways a rootkit might hide a process is just the first
step in defending against the rootkits. Detecting hidden objects is a
promising new area in rootkit detection.

For more information on the tool
http://www.scanit.net/rd/tools/03

Download the tool
http://www.scanit.net/files/tools/ProcL.zip

Cheers,
Pallav Khandhar
Sr. Security Researcher
Scanit R&D Lab

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus