Windows rootkits of 2005, part three

Windows rootkits of 2005, part three
James Butler, Sherri Sparks

The third and final article in this series explores five different rootkit detection techniques used to discover Windows rootkit deployments. Additionally, nine different tools designed for administrators are discussed.

Colapse all | Post comment

Correction re: tripwire 2006-01-06
Anonymous

Tripwire doesn't use CRC checksums. CRC has no cryptographic value - it's meant for detecting accidental file corruption and the like. It is trivial to alter a file and have it keep the same CRC

Tripwire uses cryptographic hashes - in a somewhat older version (all I could quickly find the docu...

[ more ] [ reply ]

Windows rootkits of 2005, part three 2006-06-21
david gunnells

You have the incorrect URL for reference 7. It should be http://www.europe.f-secure.com/exclude/blacklight/, but instead, it point to Fuzen, FU Rootkit: http://www.rootkit.com/project.php?id=12...

[ more ] [ reply ]