What are the experts opinions on Sysinternals rootkit tool?

--
Duncan

Re: On Rootkits... by Ted

Ted
Wed Mar 22 08:20:35 CST 2006

I have a pretty good understanding of that tool, but I don't know what type
of "opinion" you're looking for, and I don't know if I'd qualify as an
"expert" in your eyes.
--
Ted Zieglar
"A fool and his data are soon parted."

"Duncan McC" <hard@work.ok> wrote in message
news:MPG.1e8bf46ef56319ae98982a@news.microsoft.com...
> What are the experts opinions on Sysinternals rootkit tool?
>
> --
> Duncan


Re: On Rootkits... by Kerry

Kerry
Wed Mar 22 08:32:12 CST 2006

Duncan McC wrote:
> What are the experts opinions on Sysinternals rootkit tool?

It works to find some rootkits. By nature rootkits are hard to detect. The
tool points out discrepencies and it's up to the user to interpet the
results. I use it and was able to find a root kit on one computer. It was an
academic exercise. The computer was so messed up it needed a clean reinstall
anyway.

--
Kerry



Re: On Rootkits... by Ted

Ted
Wed Mar 22 09:01:48 CST 2006

Even if a rootkit is discovered, I do not believe there is a tool that can
remove it -- not yet, at least. All malware removal tools currently
available rely on the operating system in one way or another, and once a
rootkit has embedded itself the operating system has been compromised and
can no longer be trusted.

Removing a rootkit requires either a sophisticated knowledge of file systems
and rootkit technology or a clean install. Rootkit Revealer's significant
contribution - and it is by no means a finished work - is its ability to
identify anomalies in the OS that may possibly be rootkits. Previously,
rootkits were undetectable.
--
Ted Zieglar
"A fool and his data are soon parted."

"Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in message
news:u8L$p1bTGHA.1160@TK2MSFTNGP09.phx.gbl...
> Duncan McC wrote:
> > What are the experts opinions on Sysinternals rootkit tool?
>
> It works to find some rootkits. By nature rootkits are hard to detect. The
> tool points out discrepencies and it's up to the user to interpet the
> results. I use it and was able to find a root kit on one computer. It was
an
> academic exercise. The computer was so messed up it needed a clean
reinstall
> anyway.
>
> --
> Kerry
>
>


RE: On Rootkits... by Pandaman

Pandaman
Wed Mar 22 09:52:51 CST 2006

My reply is at the bottom of your message :

"Duncan McC" wrote:

> What are the experts opinions on Sysinternals rootkit tool?
>
> --
> Duncan
>

To detect a rootkit , you need a System Explorer (such as that of
Sysinternals) and a very good security software such as Nod32 or Panda . They
both detect rootkits and kill most because they have either advanced
heuristic or behaviour analyze functions .

Panda_man
--
Prevention is always better than cure !
--
My web page:
http://pandaman.my.contact.bg
Learn how to protect your computer:
http://www.microsoft.com/protect
Please , rate posts

Re: On Rootkits... by Kerry

Kerry
Wed Mar 22 20:05:20 CST 2006

Ted Zieglar wrote:
> Even if a rootkit is discovered, I do not believe there is a tool
> that can remove it -- not yet, at least. All malware removal tools
> currently available rely on the operating system in one way or
> another, and once a rootkit has embedded itself the operating system
> has been compromised and can no longer be trusted.
>
> Removing a rootkit requires either a sophisticated knowledge of file
> systems and rootkit technology or a clean install. Rootkit Revealer's
> significant contribution - and it is by no means a finished work - is
> its ability to identify anomalies in the OS that may possibly be
> rootkits. Previously, rootkits were undetectable.
>
> "Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in message
> news:u8L$p1bTGHA.1160@TK2MSFTNGP09.phx.gbl...
>> Duncan McC wrote:
>>> What are the experts opinions on Sysinternals rootkit tool?
>>
>> It works to find some rootkits. By nature rootkits are hard to
>> detect. The tool points out discrepencies and it's up to the user to
>> interpet the results. I use it and was able to find a root kit on
>> one computer. It was an academic exercise. The computer was so
>> messed up it needed a clean reinstall anyway.
>>
>> --
>> Kerry

I was able to remove the rootkit with BartPe but as I said things were so
messed up by that point it needed a clean install. The computer had been
taken over and was being used as a porn ftp server completely unknown to the
customer. It was running really slow and their hard drive was full so they
brought it to me for repair. It was an illuminating experience figuring out
what had been done. A remote control trojan had been installed. Once they
had control they resized the system partition, created a hidden partition
filled with porn, and installed the root kit which was running a ftp server.

--
Kerry



Re: On Rootkits... by Ted

Ted
Thu Mar 23 11:33:46 CST 2006

That was a fascinating post...resizing partitions, setting up ftp servers,
hide it all in a rootkit...if it wasn't such a criminal thing to do, you'd
have to admire the creators of a very sophisticated piece of software.

To paraphrase Maxwell Smart: If only they would use their knowledge for
niceness instead of evil.

--
Ted Zieglar
"A fool and his data are soon parted."

"Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in message
news:OOEJ%234hTGHA.4900@TK2MSFTNGP12.phx.gbl...
> Ted Zieglar wrote:
> > Even if a rootkit is discovered, I do not believe there is a tool
> > that can remove it -- not yet, at least. All malware removal tools
> > currently available rely on the operating system in one way or
> > another, and once a rootkit has embedded itself the operating system
> > has been compromised and can no longer be trusted.
> >
> > Removing a rootkit requires either a sophisticated knowledge of file
> > systems and rootkit technology or a clean install. Rootkit Revealer's
> > significant contribution - and it is by no means a finished work - is
> > its ability to identify anomalies in the OS that may possibly be
> > rootkits. Previously, rootkits were undetectable.
> >
> > "Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in message
> > news:u8L$p1bTGHA.1160@TK2MSFTNGP09.phx.gbl...
> >> Duncan McC wrote:
> >>> What are the experts opinions on Sysinternals rootkit tool?
> >>
> >> It works to find some rootkits. By nature rootkits are hard to
> >> detect. The tool points out discrepencies and it's up to the user to
> >> interpet the results. I use it and was able to find a root kit on
> >> one computer. It was an academic exercise. The computer was so
> >> messed up it needed a clean reinstall anyway.
> >>
> >> --
> >> Kerry
>
> I was able to remove the rootkit with BartPe but as I said things were so
> messed up by that point it needed a clean install. The computer had been
> taken over and was being used as a porn ftp server completely unknown to
the
> customer. It was running really slow and their hard drive was full so they
> brought it to me for repair. It was an illuminating experience figuring
out
> what had been done. A remote control trojan had been installed. Once they
> had control they resized the system partition, created a hidden partition
> filled with porn, and installed the root kit which was running a ftp
server.
>
> --
> Kerry
>
>


Re: On Rootkits... by Kerry

Kerry
Thu Mar 23 16:29:40 CST 2006

Ted Zieglar wrote:
> That was a fascinating post...resizing partitions, setting up ftp
> servers, hide it all in a rootkit...if it wasn't such a criminal
> thing to do, you'd have to admire the creators of a very
> sophisticated piece of software.
>
> To paraphrase Maxwell Smart: If only they would use their knowledge
> for niceness instead of evil.
>

It was amazing. It was very sophisticated work. It took me most of a day to
figure out what had been done. It also made me aware of what can be done. I
am much more conscious of security after seeing that. I can't imagine the
embarrassment when the police show up and confiscate your daughter's
computer for distributing porn. I'm sure the police would quickly figure it
out but in the meantime the press would be all over it. Their reputation
would have been ruined. It's a small town here.

--
Kerry

>
> "Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in message
> news:OOEJ%234hTGHA.4900@TK2MSFTNGP12.phx.gbl...
>> Ted Zieglar wrote:
>>> Even if a rootkit is discovered, I do not believe there is a tool
>>> that can remove it -- not yet, at least. All malware removal tools
>>> currently available rely on the operating system in one way or
>>> another, and once a rootkit has embedded itself the operating system
>>> has been compromised and can no longer be trusted.
>>>
>>> Removing a rootkit requires either a sophisticated knowledge of file
>>> systems and rootkit technology or a clean install. Rootkit
>>> Revealer's significant contribution - and it is by no means a
>>> finished work - is its ability to identify anomalies in the OS that
>>> may possibly be rootkits. Previously, rootkits were undetectable.
>>>
>>> "Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in message
>>> news:u8L$p1bTGHA.1160@TK2MSFTNGP09.phx.gbl...
>>>> Duncan McC wrote:
>>>>> What are the experts opinions on Sysinternals rootkit tool?
>>>>
>>>> It works to find some rootkits. By nature rootkits are hard to
>>>> detect. The tool points out discrepencies and it's up to the user
>>>> to interpet the results. I use it and was able to find a root kit
>>>> on one computer. It was an academic exercise. The computer was so
>>>> messed up it needed a clean reinstall anyway.
>>>>
>>>> --
>>>> Kerry
>>
>> I was able to remove the rootkit with BartPe but as I said things
>> were so messed up by that point it needed a clean install. The
>> computer had been taken over and was being used as a porn ftp server
>> completely unknown to the customer. It was running really slow and
>> their hard drive was full so they brought it to me for repair. It
>> was an illuminating experience figuring out what had been done. A
>> remote control trojan had been installed. Once they had control they
>> resized the system partition, created a hidden partition filled with
>> porn, and installed the root kit which was running a ftp server.
>>
>> --
>> Kerry



Re: On Rootkits... by Mark

Mark
Fri Mar 24 02:34:29 CST 2006

"Duncan McC" <hard@work.ok> wrote in message
news:MPG.1e8bf46ef56319ae98982a@news.microsoft.com...
> What are the experts opinions on Sysinternals rootkit tool?

Just to point out the obvious...

The people that make SysInternals tools *ARE* a pair of the worlds top
experts.

--
- Mark Randall
http://www.temporal-solutions.co.uk

"We're Systems and Networks..."
"It's our job to know..."



Re: On Rootkits... by Patrick

Patrick
Sun Mar 26 23:13:22 CST 2006

Mark Randall wrote:
> "Duncan McC" <hard@work.ok> wrote in message
> news:MPG.1e8bf46ef56319ae98982a@news.microsoft.com...
>> What are the experts opinions on Sysinternals rootkit tool?
>
> Just to point out the obvious...
>
> The people that make SysInternals tools *ARE* a pair of the worlds top
> experts.
>

Excellent point. I would add (even though I'm far from being an expert)
that SysInternals Rootkit Revealer (and any other 'rootkit revealer'
programs for that matter) are just one piece of the puzzle. As
Panda_Man pointed out in his own way, you also need a good anti-virus.
And, you should also invest in a good firewall and antispyware.

All of these, coupled with good surfing practices and security measures
inside of your browser (including but not limited to the use of a
different browser then IE) are what is required to keep you safe.

HTH
Patrick.

Re: On Rootkits... by WealthGuru

WealthGuru
Tue May 16 18:15:01 CDT 2006

Speaking of "daughters".........we have a machine that seems to be
"controlled "by "profiles byte"; hijacks IE and won't allow browsing until
you click thru. Have scoured registry, all places this neophyte can see and
no luck.
--
10natious


"Kerry Brown" wrote:

> Ted Zieglar wrote:
> > That was a fascinating post...resizing partitions, setting up ftp
> > servers, hide it all in a rootkit...if it wasn't such a criminal
> > thing to do, you'd have to admire the creators of a very
> > sophisticated piece of software.
> >
> > To paraphrase Maxwell Smart: If only they would use their knowledge
> > for niceness instead of evil.
> >
>
> It was amazing. It was very sophisticated work. It took me most of a day to
> figure out what had been done. It also made me aware of what can be done. I
> am much more conscious of security after seeing that. I can't imagine the
> embarrassment when the police show up and confiscate your daughter's
> computer for distributing porn. I'm sure the police would quickly figure it
> out but in the meantime the press would be all over it. Their reputation
> would have been ruined. It's a small town here.
>
> --
> Kerry
>
> >
> > "Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in message
> > news:OOEJ%234hTGHA.4900@TK2MSFTNGP12.phx.gbl...
> >> Ted Zieglar wrote:
> >>> Even if a rootkit is discovered, I do not believe there is a tool
> >>> that can remove it -- not yet, at least. All malware removal tools
> >>> currently available rely on the operating system in one way or
> >>> another, and once a rootkit has embedded itself the operating system
> >>> has been compromised and can no longer be trusted.
> >>>
> >>> Removing a rootkit requires either a sophisticated knowledge of file
> >>> systems and rootkit technology or a clean install. Rootkit
> >>> Revealer's significant contribution - and it is by no means a
> >>> finished work - is its ability to identify anomalies in the OS that
> >>> may possibly be rootkits. Previously, rootkits were undetectable.
> >>>
> >>> "Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in message
> >>> news:u8L$p1bTGHA.1160@TK2MSFTNGP09.phx.gbl...
> >>>> Duncan McC wrote:
> >>>>> What are the experts opinions on Sysinternals rootkit tool?
> >>>>
> >>>> It works to find some rootkits. By nature rootkits are hard to
> >>>> detect. The tool points out discrepencies and it's up to the user
> >>>> to interpet the results. I use it and was able to find a root kit
> >>>> on one computer. It was an academic exercise. The computer was so
> >>>> messed up it needed a clean reinstall anyway.
> >>>>
> >>>> --
> >>>> Kerry
> >>
> >> I was able to remove the rootkit with BartPe but as I said things
> >> were so messed up by that point it needed a clean install. The
> >> computer had been taken over and was being used as a porn ftp server
> >> completely unknown to the customer. It was running really slow and
> >> their hard drive was full so they brought it to me for repair. It
> >> was an illuminating experience figuring out what had been done. A
> >> remote control trojan had been installed. Once they had control they
> >> resized the system partition, created a hidden partition filled with
> >> porn, and installed the root kit which was running a ftp server.
> >>
> >> --
> >> Kerry
>
>
>

Re: On Rootkits... by Kerry

Kerry
Wed May 17 08:35:37 CDT 2006

Have you tried the standard methods of removing spyware?

http://www.elephantboycomputers.com/page2.html#Removing_Malware

http://www.mvps.org/winhelp2002/unwanted.htm

--
Kerry
MS-MVP Windows - Shell/User

WealthGuru wrote:
> Speaking of "daughters".........we have a machine that seems to be
> "controlled "by "profiles byte"; hijacks IE and won't allow browsing
> until you click thru. Have scoured registry, all places this neophyte
> can see and no luck.
>
>> Ted Zieglar wrote:
>>> That was a fascinating post...resizing partitions, setting up ftp
>>> servers, hide it all in a rootkit...if it wasn't such a criminal
>>> thing to do, you'd have to admire the creators of a very
>>> sophisticated piece of software.
>>>
>>> To paraphrase Maxwell Smart: If only they would use their knowledge
>>> for niceness instead of evil.
>>>
>>
>> It was amazing. It was very sophisticated work. It took me most of a
>> day to figure out what had been done. It also made me aware of what
>> can be done. I am much more conscious of security after seeing that.
>> I can't imagine the embarrassment when the police show up and
>> confiscate your daughter's computer for distributing porn. I'm sure
>> the police would quickly figure it out but in the meantime the press
>> would be all over it. Their reputation would have been ruined. It's
>> a small town here.
>>
>> --
>> Kerry
>>
>>>
>>> "Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in message
>>> news:OOEJ%234hTGHA.4900@TK2MSFTNGP12.phx.gbl...
>>>> Ted Zieglar wrote:
>>>>> Even if a rootkit is discovered, I do not believe there is a tool
>>>>> that can remove it -- not yet, at least. All malware removal tools
>>>>> currently available rely on the operating system in one way or
>>>>> another, and once a rootkit has embedded itself the operating
>>>>> system has been compromised and can no longer be trusted.
>>>>>
>>>>> Removing a rootkit requires either a sophisticated knowledge of
>>>>> file systems and rootkit technology or a clean install. Rootkit
>>>>> Revealer's significant contribution - and it is by no means a
>>>>> finished work - is its ability to identify anomalies in the OS
>>>>> that may possibly be rootkits. Previously, rootkits were
>>>>> undetectable.
>>>>>
>>>>> "Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in message
>>>>> news:u8L$p1bTGHA.1160@TK2MSFTNGP09.phx.gbl...
>>>>>> Duncan McC wrote:
>>>>>>> What are the experts opinions on Sysinternals rootkit tool?
>>>>>>
>>>>>> It works to find some rootkits. By nature rootkits are hard to
>>>>>> detect. The tool points out discrepencies and it's up to the user
>>>>>> to interpet the results. I use it and was able to find a root kit
>>>>>> on one computer. It was an academic exercise. The computer was so
>>>>>> messed up it needed a clean reinstall anyway.
>>>>>>
>>>>>> --
>>>>>> Kerry
>>>>
>>>> I was able to remove the rootkit with BartPe but as I said things
>>>> were so messed up by that point it needed a clean install. The
>>>> computer had been taken over and was being used as a porn ftp
>>>> server completely unknown to the customer. It was running really
>>>> slow and their hard drive was full so they brought it to me for
>>>> repair. It was an illuminating experience figuring out what had
>>>> been done. A remote control trojan had been installed. Once they
>>>> had control they resized the system partition, created a hidden
>>>> partition filled with porn, and installed the root kit which was
>>>> running a ftp server.
>>>>
>>>> --
>>>> Kerry



Re: On Rootkits... by Zoned

Zoned
Wed May 17 09:02:19 CDT 2006

There are more rootkit removers at www.antirootkit.com,

regards
Zoned


RE: On Rootkits... by Wildthing

Wildthing
Thu May 25 16:15:02 CDT 2006

How do I get rid of rootkit and is it bad for my system ?

--
Wildthing


"Panda_man" wrote:

> My reply is at the bottom of your message :
>
> "Duncan McC" wrote:
>
> > What are the experts opinions on Sysinternals rootkit tool?
> >
> > --
> > Duncan
> >
>
> To detect a rootkit , you need a System Explorer (such as that of
> Sysinternals) and a very good security software such as Nod32 or Panda . They
> both detect rootkits and kill most because they have either advanced
> heuristic or behaviour analyze functions .
>
> Panda_man
> --
> Prevention is always better than cure !
> --
> My web page:
> http://pandaman.my.contact.bg
> Learn how to protect your computer:
> http://www.microsoft.com/protect
> Please , rate posts

Re: On Rootkits... by Shenan

Shenan
Thu May 25 17:55:05 CDT 2006

Wildthing wrote:
> How do I get rid of rootkit and is it bad for my system ?

Search using Google!
http://www.google.com/
(How-to: http://www.google.com/intl/en/help/basics.html )

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html



Re: On Rootkits... by Ted

Ted
Fri May 26 08:10:51 CDT 2006

You can't and yes.

--
Ted Zieglar
"Backup is a computer user's best friend."

"Wildthing" <Wildthing@discussions.microsoft.com> wrote in message
news:1928B8AD-7008-409F-8805-A90C71A21BB0@microsoft.com...
> How do I get rid of rootkit and is it bad for my system ?
>
> --
> Wildthing
>
>
> "Panda_man" wrote:
>
> > My reply is at the bottom of your message :
> >
> > "Duncan McC" wrote:
> >
> > > What are the experts opinions on Sysinternals rootkit tool?
> > >
> > > --
> > > Duncan
> > >
> >
> > To detect a rootkit , you need a System Explorer (such as that of
> > Sysinternals) and a very good security software such as Nod32 or Panda .
They
> > both detect rootkits and kill most because they have either advanced
> > heuristic or behaviour analyze functions .
> >
> > Panda_man
> > --
> > Prevention is always better than cure !
> > --
> > My web page:
> > http://pandaman.my.contact.bg
> > Learn how to protect your computer:
> > http://www.microsoft.com/protect
> > Please , rate posts


RE: On Rootkits... by Imhotep

Imhotep
Fri May 26 20:18:41 CDT 2006

Wildthing wrote:

> How do I get rid of rootkit and is it bad for my system ?
>


...are you serious?

Re: On Rootkits... by Tom

Tom
Fri May 26 21:11:36 CDT 2006

...once again, the troll you are.

"Imhotep" <imhotep@nospam.com> wrote in message
news:JLqdneMfkYhuNerZnZ2dnUVZ_sGdnZ2d@adelphia.com...
> Wildthing wrote:
>
>> How do I get rid of rootkit and is it bad for my system ?
>>
>
>
> ...are you serious?



Re: On Rootkits... by Imhotep

Imhotep
Fri May 26 23:34:18 CDT 2006

Tom [Pepper] Willett wrote:

> ...once again, the troll you are.

Really? I was asking a serious question. You are just wasting my time. Yet
again, it seems you are the foolish troll....

Idiot....


--Im

> "Imhotep" <imhotep@nospam.com> wrote in message
> news:JLqdneMfkYhuNerZnZ2dnUVZ_sGdnZ2d@adelphia.com...
>> Wildthing wrote:
>>
>>> How do I get rid of rootkit and is it bad for my system ?
>>>
>>
>>
>> ...are you serious?


Re: On Rootkits... by Alun

Alun
Fri Jun 02 21:09:34 CDT 2006

Ted Zieglar wrote:
> "Wildthing" <Wildthing@discussions.microsoft.com> wrote in message
> news:1928B8AD-7008-409F-8805-A90C71A21BB0@microsoft.com...
>> How do I get rid of rootkit and is it bad for my system ?
>
> You can't and yes.

That's a needlessly pessimistic assessment.

The answer is more that if you know what the root kit is, and if there has
been no subsequent infection, then yes, you can use whatever removal tools
exist, and stand a good chance of rescuing your system.

If you want anything better than "a good chance", or you're not sure of the
"if"s, you'll want to reformat and reinstall the system.

Of course, if you install the system exactly the same way as you did, and
use it in exactly the same way as you did, you'll find yourself infected
again with the same rootkit.

Alun.
~~~~
[Please don't email posters, if a Usenet response is appropriate.]
--
Texas Imperial Software | Find us at http://www.wftpd.com or email
23921 57th Ave SE | alun@wftpd.com.
Woodinville WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(425)807-1787 | Try our NEW client software, WFTPD Explorer.