SysInternals Releases RootkitRevealer

Brian writes "In the wake of news that Microsoft is developing prototype software to detect rootkits, SysInternals has released a free rootkit detection tool named RootkitRevealer for all Windows systems NT4+. RootkitRevealer works by "comparing the results of a system scan at the highest level with that at the lowest level," and detects every known rootkit at rootkit.com. They also report that it is impossible to know for sure that a given system is clean from within it, but that defeating their tool would require a level of sophistication not yet seen. You can download RootkitRevealer."

Strange...

[bigtallmofo]

Every time I try to go to www.sysinternals.com to find the new Rootkit removal application, my system shuts down automatically.

Probably nothing to worry about.

Bloated Software Giant Ahead of the Curve Again

[Anonymous Coward]

Wow. Pop-up blocking, rootkit detection, basic network security... isn't it amazing how an enormous patent library and billions of dollars encourages so much innovation? It's like they're ten years ahead of everyone else.

Wait... no, the other way around...

Free Sony PSPs [tinyurl.com]. It's real. It's here.

Rootkit?

[Fls'Zen]

I didn't think people needed rootkits for windows...

So this is...

[JustNiz]

>> RootkitRevealer works by "comparing the results of a system scan at the highest level with that at the lowest level,

So this is a rootkit in itself.

I don't know that I'd trust Microsoft anymore than anyone else running rootkits on my ststem.

Looking forward...

[Apiakun]

defeating their tool would require a level of sophistication not yet seen

What, until tomorrow?

LOL

[http101]

"RootkitRevealer works by "comparing the results of a system scan at the highest level with that at the lowest level," and detects every known rootkit at rootkit.com."

So its kinda like telling my computer to turn its head and cough, right? *squeeze*

Netcraft has announced; "God exists"

[eatmywake]

...and goes by the alias "SysInternals".

Forget the vatican and mecca, point your browsers to http://www.sysinternals.com and pay homage.

Re:Strange...

[Anonymous Coward]

Yeah, should probably just turn off that buffer overrun protection, don't know what it's good for anyways. Also you should set your administrative password to blank and share out your entire C drive with Everyone granted full control, just to make things easier.

Re:RootKit in windows?

[tverbeek]

Why are they called rootkits in windows, when the superuser is called "administrator" and not "root"?

For the same reason trackpads, wireless pointing devices, and such are called "mice", even though they look nothing like a mouse.... why solid state storage devices are called "flash disks" or "flash drives", even though there's nothing flat and circular in them and no moving parts... why the stuff in the middle of pencils is called the "lead", even though it's mostly graphite... why magazines featuring stories told with sequential art are called "comic books", even though they're usually not humorous.

Re:Rootkit?

[Geek of Tech]

Wouldn't the appearance that the computer hasn't been compromised lead one to become suspicious?

:P

Re:How do you REMOVE a rootkit?

[3.5 stripes]

Format c:

Re:RootKit in windows?

[ratnerstar]

Because "rootkit" sounds cool, like a plumber's tool or some sort of kinky sexual practice.

In other news...

[eatjello]

Microsoft purchases SysInternals this week; new Microsoft rootkit exposer available via Windows Update.

Re:Rootkit?

[Carnildo]

Its getting insane and I favor criminal rather than civil charges if spyware makers began to make trojan horse rootkits.

Personally, if that occurs, I favor dynamite charges over either of the above.