RE: Help, possible rootkit

From: k levinson (levinson_k_at_yahoo.com)
Date: 10/25/04

  • Next message: Bowes, Ronald (EST): "RE: Help, possible rootkit"
    Date: Mon, 25 Oct 2004 07:34:24 -0700 (PDT)
    To: Incidents@securityfocus.com
    
    

    In addition to the other advice already given, if
    you're still interested in trying to confirm or deny
    whether this could be a root kit, even though RKDetect
    found nothing...

    Try scanning and inspecting the computer using the
    same tools you've used, as well as up to date
    anti-virus and looking at the startup values in the
    Registry... but instead of using them remotely, try
    using them across the network through Windows
    networking from another Windows computer, or after
    slaving the hard drive to another Windows system.

    [Booting to another OS such as a Knoppix or
    www.bitdefender.com CD to inspect the file system for
    new or unusual files might help as well, although
    those may not support detection of files hidden by
    ADS, and many of your Windows detection tools won't
    work.]

    Try also searching for files that have changed in the
    past day or three.

    There are programs that let you inspect the programs
    that start up with Windows, such as the MSCONFIG
    command, Silent Runners from www.silentrunners.org
    [looks in some places the others don't], Startup List,
    Startup Cop, etc.

    LADS from www.heysoft.de and ADSSpy will let you
    inspect files hidden by ADS. Note that Windows uses
    ADS for image thumbnails and XP SP2 AES zone
    information. But anything malicious would probably be
    easily overlooked amongst the many legitimate ADS
    files you're likely to find.

    I wonder whether you've run the command NETSTAT -ANO
    ?

    Inspecting your firewall logs or running Ethereal
    locally to look forfor unusual network traffic from
    your system might also be helpful in some
    circumstances.

    - karl levinson

    > --- BillyBob <billybobknob@hotmail.com> wrote:
    >
    > > I have noticed that my XP system is behaving like
    I
    > > have a rootkit.

    > > Any more suggestions ?
    > > Any more rootkit finding tools for Windows ?
     

            
                    
    __________________________________
    Do you Yahoo!?
    Yahoo! Mail - You care about security. So do we.
    http://promotions.yahoo.com/new_mail


  • Next message: Bowes, Ronald (EST): "RE: Help, possible rootkit"

    Relevant Pages

    • Re: God Mode In Windows 7
      ... Windows Explorer doesn't require a confirmation click after ...    I wrote my own file renamer programs in Visual Basic. ... the word "Network". ... I use the program "startuprun" to manage my startup programs. ...
      (soc.retirement)
    • Re: windoes explorer/internet explorer
      ... load auto-magically on startup: ... ZA causes problems with certain applications and system services which load ... Especially true of Windows 9x/ME. ... > anything else that would normally have access to the network, ...
      (comp.security.firewalls)
    • Re: windoes explorer/internet explorer
      ... load auto-magically on startup: ... ZA causes problems with certain applications and system services which load ... Especially true of Windows 9x/ME. ... > anything else that would normally have access to the network, ...
      (comp.security.firewalls)
    • Re: XP Home Edition freezes at start-up
      ... It 'may' be that this setup is now waiting for a network connection or network login. ... > Did the System Restore complete successfully all the way? ... > While in Safe Mode of XP, you should look at all the startup programs, and startup settings. ... > MVP Windows - Shell / User ...
      (microsoft.public.windowsxp.help_and_support)
    • RE: Long Win XP PRO Start Time
      ... initialized at startup and logon. ... Let's do the following steps to let the system waits for the network at the ... Go to Local Computer Policy> Computer Configuration> Windows Settings ...
      (microsoft.public.windowsxp.security_admin)