HiddenFinder, Process Master & RootKitShark

Does anyone have any experience with HiddenFinder, Process Master or RootKitShark? Any comments or opinions would be very much appreciated.


Peace & Love,

CogitoErgoSum

 

Well, I found HiddenFinder yesterday while googling; I did try it because I thought it was freeware (according to download sites I've seen before), but it is not : http://www.wenpoint.com/product/product.php


It's maybe a good tool, but for now there are better freeware alternatives , with more options.

I don't know the other two.


nicM

 

nicM,

Thanks for you input on HiddenFinder.


Peace & Love,

CogitoErgoSum

 

Hi nicM

What freeware would you recommend to detect hidden processes and drivers?

 

Apart from all the specificRootkit detectors available, here's a just a few more Hidden Process etc apps to be going on with.

Procenum hidden processes detection http://forensic.seccure.net/

HookExplorer and SysAnalyzer http://labs.idefense.com/labs-software.php?show=19

Process Hunter http://www.wasm.ru/toollist.php?list=21

HFind http://www.foundstone.com/resources/proddesc/forensic-toolkit.htm

Do a search for these too, knlps V0.4 and Kernal SC 1.3


StevieO

 

Hi Kaupp,

I had especially IceSword in mind, when I told this. It offers a lot of diagnostic tools. Another one : DarkSpy, which is a good alternative too, working as a monitor (in opposition to scanners), very powerful. I've not tried it yet, but there is Gmer tool too.

I've noticed that this program, EkinX, is good too, to detect hidden services and drivers; although this is not specifically designed as an anti-rootkit (link is in french) : http://www.ekinox-team.com/ekinx.php


ps : Here is a link to an article Kareldjag has made about rootkits, very interesting : http://kareldjag.over-blog.com/article-1232492.html

nicM

 

OK so are these apps any good or not? RootkitShark doesn´t seem to exist anymore btw. And I always wondered, if tools like Process Master can detect certain rootkits, why Process Explorer can´t?