Another new anti Rootkit and hook analyzer

RELEASED TODAY:

For now this one is free!

http://www.resplendence.com/hookanalyzer

http://www.resplendence.com/downloads

Not only for detecting rootkits, but a nice kernel hook analyzer as well

 

Interesting Program Thanks

 

all this are Rootkit on you system?

if they are can you please explain me how you remove that cause in my system show like 6 red like yours

thanks

 

1: No these are NOT all rootkits or malware or unwanted software
so be carefull with removing them.

2: This tool ONLY shows which programs use these kind of kernel hooks
this can be malware but Anti-malware as well.

3: If you are not sure please write here what is in those 6 lines,
perhaps we can identify them.

 

thanks i got more the 6 now

 

Thanx for the heads-up

D347bus.sys is used by Daemon Tools among others, as far as I'm aware

 

Hi Mata7,

The lines regarding Kaspersky seems oke for me,
i see the same lines here on one of the pc's where i am running KIS2006Beta, as a matter of fact i in fact see more lines on that pc.

The other ones regarding D347bus.sys , i am not sure,
but concidering the fact that you are running Kaspersky
i asume it is ok as well (95% change) read this:

d347bus.sys file information

The process PnP BIOS Extension belongs to the software unknown by unknown. Description: File d347bus.sys is located in the folder C:\Windows\System32\drivers. The file size on Windows XP is 155136 bytes.
The driver can be started or stopped from Services in the Control Panel or by other programs. There is no file information. The program is not visible. The service has no detailed description. File d347bus.sys is not a Windows core file. Therefore the technical security rating is 5% dangerous, however also read the users reviews.

Important: Some malware can camouflage themselves as d347bus.sys, particularly if they are located in c:\windows or c:\windows\system32 folder. Thus check the d347bus.sys process on your pc whether it is pest.

If nobody else informs you different,
you don't have to worry.

Btw. What is your native language?

 

RipvanTinkle is correct,

Search on d347bus.sys on http://www.daemon-tools.cc/dtcc/index.php
makes things clear.

There is even a a347bus.sys which is used by 'alcohol'

 

- Info on common log entries -

http://www.sysinternals.com/Forum/forum_posts.asp?TID=2408&PN=1

Advicer

 

It would have been nice if it had offered a way of exporting the list to a txt file (or anything more easily postable then a screenshot)

Regards,

Pieter

 

thanks for all you info, my native lenguage is spanish

 

I totally agree, i hope they will create this feature.

 

These are my kind of "hooks"!

 

Hey Pete

How goes the battle?

Are you useing Appdefend in that post? From what I have seen, It appears when using Appdefend along with PG, people seem to see the hooks overlapping and Appdefend's hooks usualy show more frequent.

Bruce

 

What do you mean show more frequent? It depends on the install order I think. At least that was so, when i installed PG first then Appdefend. And compared with installing Appdefend then PG.

 

Hi, Bruce! No, that's not AppDefend, it's just PG/RegDefend.

"the battle" is on-going and multi-fronted. "Skirmishes" going well going on some fronts but I need a lot more "troops" for the front lines and major engagements. Signed up yet? Pete

 

Hello All,
Cool Free tool. Good for asking questions and seeking help for things that look suspicious, but to those of us not real savy and tech wizards it is difficult for us to use to get rid of a nasty.

Its user base would be very small IMHO.

Am I missing something?

 

When I tryed to install it Pest Patrol intercepted it and said it was the buddy 2 spy so I killed the install. Whats up with that?

 

Pestpatrol King of False positive strikes again

 

A search came up with this http://www.versiontracker.com/dyn/moreinfo/win/43343 as the only thing I could find and nothing indicating it is spy-ware. I give it a cautious FP but am curious why the application would need a file that tracks chat buddies. Amid the sounds of alarm bells in my head I think I will pass on this one for now unless the original poster can address the issue.

Edit: Hmmm, http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453096498 Its not a FP I guess.

 

I installed in on a vmware machine, and looked for the files that should have being installed (based on your urls). Nada. FP?

 

Maybe its PP's version of "Not a virus risk-ware" or simple mistaken identity. The nature of the application would normally cause it to show up on the radar but it was ignored (as far as it got anyway) by KAV, Reg Def and App Def. The vender's name rings a bell, confirm they are reputable?

 

As a licenced user of PestPatrol, i think it is a great product,
it can find malware that others can't sometimes.

But i would not recommend it to a novice user,
because deviladvocate couldn't say it better;

It is the King of False positives! (as proven in this case)

But if you haven't got a problem with that (like me)
it is not a bad prog.

 

Having an analyser that could identify multiple hook chains would be useful in such cases. Indeed that should be the next step - after all, if only the first hook in a chain is identified then this means that installing a security application on a rootkitted system (resulting in its hooks being installed over the rootkit's) could end up obscuring the rootkit hooks (though they would still be active).

 

While it is true that PP is often misunderstood because it tries to detect "hackerz tools" and other things like P2p clients, when I say it is King of FP, I do not refer to such cases. I only refer to cases where it states without a doubt it is some wellknown specific spyware/adware or keylogger.

Even in this case in question, it states that it is "buddy 2 spy" which is obviously wrong. If it said it was some generic.hackertool, then I would be okay with it.

That has always being the case with pest patrol, its signatures are very 'loose'. Kind of like looking at a green apple, and then from now on it learns that everything that is green is an apple.