New Rootkit Detector Released

Rootkit V2 Detector BETA1 - FILESYSTEM ENGINE - This is an updated version of the previous Rootkit V0.62 Detector

From the DL README file


Author: Andres Tarasco Acuña

Rkdetector filesystem is an advanced rootkit detector software that includes
its own ntfs and FAT32 filesystem Driver.

This drivers allows rkdetector to perform the following tasks:

- Filesystem browser
- Rootkit detector (search for hidden files)
- ADS (alternate Data Streams) Scanner
- Wipe Disk (secure file deletion Dod Compliant Erase both file and mft entries)
- Data Recovery (recovery of deleted files)
- Registry browser (Raw registry files browser)
- Hidden registry key scanner (search for hidden keys/services)

NOT INCLUDED IN THIS BETA RELEASE:

- Export results
- Perform wipe /recovery with FAT32 filesystems.
- Search filter ( search for A/C/D/M file times)
- IAT analyzer / Patcher.
- Rootkits Patterns
- Ports monitor.
- Malware eliminator.

There is also available a private rkdetector v2.0 Filesystem console Edition edition that also includes:

- Console release
- perform Custom security checks.
- Xml /CSV results

Download here

http://translate.google.com/transla...&hl=en&ie=UTF-8&oe=UTF-8&prev=/language_tools

Forum here

http://216.239.39.104/translate_c?h...ellsec.net/index.php?c=5&prev=/language_tools


StevieO

 

thanks steevo. System volume info is usually hidden correct? I also wondering about the "tracking log" and the "remote database"

http://img472.imageshack.us/img472/408/svi3kv.jpg

 

This could be a keeper!

Have been waiting for this for some time.
Developed by the writer of rkdetector 0.6

The 'mountain range data" file and "tracklog" file are nuisance files and crop up all over the place. seem not to be anything to be concerned about.

http://www.rkdetector.com/

 

Or http://www.rootkitdetector.com/

even

 

Not sure why but this is what I get when running this version.

PG blocked wmiprvse.exe from terminating mshta.exe

 

rkdetector v2.0 beta support forum Here.

-- Tom

 

Hi,

Why doea Mcafee still detect this as HKH-Keylog? There is no other info at McAfee on there site about this one - could it be a false postive??

I think its ok , but what do you guys think

T

 

Updated, was a false postive

T