Would this tell you if you have a rootkit onboard?

Discussion in 'Computer Support' started by Pat, Nov 13, 2005.

  1. Pat

    Pat Guest

    Could you tell if a rootkit is on your system by simply creating a text
    file and saving it as "$sys$filename.txt" (maybe in the win\sys folder)
    then checking to see if it is visible? If so, it would sure be an easy
    way to determine if your system is hit. Seems too simple given the
    rootkit revealers available.
     
    Pat, Nov 13, 2005
    #1
    1. Advertisements

  2. Pat

    Trax Guest

    |>Could you tell if a rootkit is on your system by simply creating a text
    |>file and saving it as "$sys$filename.txt" (maybe in the win\sys folder)
    |>then checking to see if it is visible? If so, it would sure be an easy
    |>way to determine if your system is hit. Seems too simple given the
    |>rootkit revealers available.

    Rootkit's can be very hard to find.
    http://www.sysinternals.com/Utilities/RootkitRevealer.html
    How Mark Russinovich found the Sony Rootkit.

    The Sony Rootkit used $sys$ to hide things, all are different.
     
    Trax, Nov 13, 2005
    #2
    1. Advertisements

  3. Pat

    Duane Arnold Guest

    Long

    http://www.windowsecurity.com/articles/Hidden_Backdoors_Trojan_Horses_and
    _Rootkit_Tools_in_a_Windows_Environment.html

    Short

    http://tinyurl.com/klw1

    Duane :)
     
    Duane Arnold, Nov 13, 2005
    #3
  4. Pat

    Pat Guest


    Ah-So, $sys$ would only expose a Sony rootkit. Thanks!
     
    Pat, Nov 13, 2005
    #4
  5. Pat

    Barry OGrady Guest

    That will only work with the Sony DRM rootkit.
    Create a file called $sys$canary on your desktop.

    Barry
    =====
    Home page
    http://members.iinet.net.au/~barry.og
     
    Barry OGrady, Nov 13, 2005
    #5
  6. Pat

    ellis_jay Guest

    Thanx for the link Duane. MwSnap'ed them and saved for later

    --

    Their ethics are a short summary of police ordinances: for them the
    most important thing is to be a useful member of the state, and to air
    their opinions in the club of an evening; they have never felt the
    homesickness for something unknown and far away, nor the depths which
    consists in being nothing at all. ___________Soren Kierkegaard

    Ellis_jay
     
    ellis_jay, Nov 14, 2005
    #6
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.