|
|
| What is a "Rootkit"? A rootkit is a set of software tools frequently used by a third party (usually an intruder) after gaining access to a computer system. These tools are intended to conceal running processes, files or system data, which helps an intruder maintain access to a system without the user's knowledge. Rootkits are known to exist for a variety of operating systems such as Linux, Solaris and versions of Microsoft Windows. Rootkits are not new, they've been around for many years, but recently have been rediscovered by hackers and malicious programmers seeking to gain access to personal computers for nefarious reasons. A rootkit typically hides logins, processes, files, and logs and may include software to intercept data from terminals, network connections, and the keyboard. In many instances, rootkits are counted as trojan horses. A rootkit is often used to hide utilities used to abuse a compromised system. Backdoors and Trojans are examples. Recently, Sony Corp. was found to be installing Rootkits as part of a copy-protection scheme on its CDs. Sony is now capitulating and offering "rootkit free" disks to livid customers in exchange for the infected CDs they purchased. Detecting Rootkits We used a tool called "Rootkit Revealer" by Sysinternals. The following is an actual, unedited, scan log of rootkits being detected by the Rootkit Revealer" application. These rootkits were being detected in some Incredimail files. What's interesting is that Incredimail was uninstalled from this particular computer (one of ours) over six months ago using Incredimail's uninstaller. We're not sure why Incredimail would be using rootkits or even if these are indeed rootkits, but it's very suspicious. If any of you use Incredimail and run Rootkit Revealer and see similar results D:\Program Files\IncrediMail\bin\
Im3D.dll 9/25/1619 4:47 AM 80.04 KB Visible in Windows API, but not in MFT
or directory index. How to find out if your computer is
infected with rootkits:
Help Support Our Site! Make our new Start page - Your new Start page! Click the start button
Move up to InfoAve Premium Edition - We hope you will join the thousands who have already made the switch. Our InfoAve Premium Newsletter contains almost three times more information than Information Avenue free edition, and no third party advertisements! Upgrade to InfoAve Premium right now! An InfoAve Premium Newsletter Subscription is only $11.95 per year, that's 52 great issues of news, tips, tricks, and features you can really use. Subscribe today, and save 50% on our new super Premium E-book ! ©2005 Cloudeight Internet LLC |
The above advertisements are provided by Google. Content of these ads is the responsibilty of Google, Inc. |
