Re: Detecting rootkits?

From: Susan Bradley, CPA aka Ebitz SBS Rocks [MVP] (sbradcpa_at_pacbell.net)
Date: 07/21/03 

Date: Sun, 20 Jul 2003 15:49:55 -0700

Root kit is typically a "Unix" term. If someone has enabled the guest account
or has the password to the Administrator account, they they "own" a Windows box.

In general Download Microsoft Baseline Security Advisor
Microsoft Baseline Security Analyzer V1.1:
http://www.microsoft.com/technet/security/tools/Tools/mbsahome.asp?frame=true

GFI LANguard Network Security Scanner:
http://www.gfi.com/downloads/downloads.asp?pid=8&lid=1
This scans your system for trojans, etc.

JasonW wrote:

> Does anyone have a recommendation for testing for the presence of rootkit on
> a Windows system?
> I went to www.chkrootkit.org, but they seem to concentrate on UNIX based
> systems.
>
> This is a fairly new subject for me, so if anyone has some experience or can
> direct me towards more information, I'd appreciate it.
>
> -JasonW 

--
"Don't lose sight of security.  Security is a state of being, not a
state of budget.  He with the most firewalls still does not win.
Put down that honeypot and keep up to date on your patches.  Demand
better security from vendors and hold them responsible.  Use what
you have, and make sure you know how to use it properly and effectively."
  ~ Rain Forest Puppy
http://www.wiretrip.net/rfp/txt/evolution.txt

Relevant Pages