AntiRootkit from Mcafee Avert Labs

[Perman]

Hi, folks: Just for the new info only. McAfee's Avert Labs has just joined the antirootkit wagon by releasing its Rootkit Detective 1 beta. Link is from MajorGeeks.com Few words of caution has been attached, read prior to useing. Have nice one.

[Meriadoc]

Rootkit Detective 1 beta
-{ Quote: "
This tool has been tested for compatibility against the following products
1. McAfee Virus Scan Enterprise 8.0i
2. McAfee Virus Scan Online 11
3. F-Secure Internet Security Suite 2006
4. Kaspersky Internet Security 2006
5. CA eTrust Internet Security Suite
6. TrendPC-Cillin Internet Security 2006
7. AVG Anti-Virus plus Firewall 7.1
8. TrendPC-Cillin Internet Security 2006
9. Sygate Personal Firewall
10. Norton Antivirus 2006
11. McAfee Antispyware Enterprise 8.0
12. MASE Plugin for VSE8.0i
13. Zone Alarm
14. McAfee Virus scan Enterprise 8.5i
15. Microsoft Windows OneCare
BETA KNOWN ISSUES
- This tool will detect registry entries pertaining to McAfee Entercept Products if installed on your system.
- This tool will detect mfehidk.sys file pertaining to McAfee Antispyware Enterprise (Standalone) as a hooked service.
- This tool will detect IAT/EAT hooks in Windows 2000 SP4 system pointing to shim.dll.
- This tool will detect vsdatant.sys from Zone Alarm as hooked service for rootkit like behavior.
- This tool will detect Goback2k.sys as hooked service on system having Go Back software installed system for rootkit like behavior.
- This tool will detect fsndis5.sys as hooked service from F-Secure if F-Secure Internet Security Suite 2006 is installed on the system
- This tool will detect klif.sys as hooked service from Kaspersky if Kaspersky Internet Security 2006 is installed on the system.
- This tool will detect FireTDS.sys as hooked service from McAfee if McAfee Desktop Firewall is installed on the system.
- This tool will detect Hidsys.sys as hooked service from McAfee if McAfee Host Intrusion Prevention is installed on the system.
- This tool will detect Service Name ZwCreateThread when VSE product is installed on the system.
- This tool will not run on Windows 2000 platforms when Kaspersky Internet Security 2006 is installed.
- This tool will detect many IAT/EAT hooks and SSDT hooks of legitimate applications.
NOTE: Some or all of the above issues may be addressed in the future releases." }-
and thats all I can tell because I cant get it work to test anything.

[Meriadoc]

working...but not detecting much,
will test again
edit : update

[EASTER.2010]

More and more AV's and AS's are getting onboard with Rootkit Detections which is a welcome sight to see. All i can say is be patient, many of these, especially AV's already have a full schedule keeping up with virus databases but over time they will improve, of that there is no doubt surely, hopefully?

[TonyKlein]

http://forum.sysinternals.com/forum_posts.asp?TID=9462&PN=1

[EASTER.2010]

Long, long time no see but great to see you again Tony Klein

Hope all is well with you these days. Seems like old times when i run across your posts.

Take good care friend and ALL THE BEST TONY! :thumb:

Thanks