Preventing Root kit viruses with Samurai

[arran]

hi has any tried or tested Samurai? how effective would the disable rootkits
be in prenventing root kit viruses and malware from installing?


http://img340.imageshack.us/img340/3276/finbj2.jpg (http://imageshack.us)

[CubonesCastle]

I realy dont know Buddy , i have it on my system but i'm not even sure if its worked.

I get this in the log

02/14/08 01:26:43 INFO Starting...
02/14/08 01:26:47 WARNING Unable to set cisvc
02/14/08 01:26:47 ERROR Unable to stop cisvc
02/14/08 01:26:47 WARNING Unable to set Messenger
02/14/08 01:26:47 ERROR Unable to stop Messenger
02/14/08 01:26:47 WARNING Unable to set NetDDE
02/14/08 01:26:47 ERROR Unable to stop NetDDE
02/14/08 01:26:49 ERROR Unable to start KernelHooks.sys. Error = 3
02/14/08 01:26:49 ERROR Unable to install rootkit device driver
02/14/08 01:26:50 WARNING Unable to set WINS
02/14/08 01:26:50 ERROR Unable to stop WINS
02/14/08 01:26:53 ERROR Unable to start SysTrayHook.exe. Error = 3

So meh. Looks nice if it dose what it says it dose ^^

[Kerodo]

I don't know that it has been updated in a while, so I would think there are probably other newer alternatives for that purpose....

[yankinNcrankin]

In a nutshell, the prevent rootkits feature is a bit strong, it'll prevent your USB devices from loading properly example, external DVD drive won't read any discs at least on my box I have to disable the feature and reboot then I can use my externals'. The prevent rootkits feature simply breaks the true function of the rootkit or driver loading, even if, in some cases related files belonging to the rootkit-driver are still able to write themselves to disc the purpose of the rootkit-driver won't function correctly as intended. Its a great hardening tool.

[aigle]

-{ Quote: "hi has any tried or tested Samurai? how effective would the disable rootkits
be in prenventing root kit viruses and malware from installing?


http://img340.imageshack.us/img340/3276/finbj2.jpg (http://imageshack.us)" }-
Why bother, use ThreatFire instead! Besides all others, it stops drivers too!

[yankinNcrankin]

For me the answer is simple, I game and ThreatFire crashes alot of my games while online especially when I use trainers.

[EASTER]

-{ Quote: "In a nutshell, the prevent rootkits feature is a bit strong, it'll prevent your USB devices from loading properly example, external DVD drive won't read any discs at least on my box I have to disable the feature and reboot then I can use my externals'. The prevent rootkits feature simply breaks the true function of the rootkit or driver loading, even if, in some cases related files belonging to the rootkit-driver are still able to write themselves to disc the purpose of the rootkit-driver won't function correctly as intended. Its a great hardening tool." }-

Just to update on this rather distant thread for those who might not know.

Indeed it's so STRONG!

......the Prevent Rootkits From Installing certainly also will STOP! cold IceSword/RKU and various deep ARKD's analysis apps from loading their driver, AS WELL AS Device\Physical Memory attempts as well as the USB Devices, but you DON'T NEED TO DISABLE & REBOOT! for these apps.

Simply use Nirsoft's (standalone) Serviwin services/driver app and simply change the STATUS TYPE to STOP (TESTED XP Pro SP2)

http://www.nirsoft.net/utils/serviwin.html

However, after some additional testing my USB Pens are still BLOCKED! and that's likely to require disable and a reboot. (Still Working On Some Solution To This One)

EASTER

[arran]

Yea I had to disable the rootkit feature on my Samurai in the end because I cauldn't start up certain games because it was blocking the games which needed to load rootkits into the memory.