|
Posted by Gregg Hill on April 20, 2006, 3:17 pm
If you were Registered and logged in, you could reply and use other advanced thread options
I have been looking at http://research.microsoft.com/rootkit/ and
http://www.sysinternals.com/Utilities/RootkitRevealer.html to check the
system (I am going there Monday).
The guy who is sending me out has a brother who works for Homeland Security,
but he (his brother) will not reveal the name of the tools he uses. He
claims that the software is written to the drive and will survive fdisk and
even unconditional formatting.
Scary stuff!
Gregg Hill
> You may be referring to something called a rootkit. While a full
> explanation
> is beyond the scope of a news post, a rootkit makes itself part of the
> operating system. This characteristic makes the rootkit invisible to
> currently available antivirus and anti-malware software. In fact, any
> software running on the operating system is unable to distinguish the
> rootkit from the rest of the operating system.
>
> As you can imagine, this is a most serious threat.
>
> At present, there is no software available that can positively identify a
> rootkit. There are a handful of programs that can identify abnormalities
> that may be rootkits, but it's left to the user to decide whether or not
> the
> findings are indeed rootkits. Since rootkits are invisible to software
> running on the operating system, these programs examine the logical
> structure of the hard disk. It takes a highly sophisticated knowledge of
> file systems to do this. Fortunately, the same level of sophistication is
> needed to create a rootkit in the first place, but you can bet it's only a
> matter of time before this knowledge is assembled into a package that your
> typical script-kiddie will try.
>
> To my knowledge, rootkits cannot be removed -- unless the rootkit creator
> provides specific instructions. The only way out is a clean install.
>
>
> --
> Ted Zieglar
> "Backup is a computer user's best friend."
>
>> Hello!
>>
>> I have heard that some virus writers are now able to write their files
> into
>> a part of the hard drive that antivirus software cannot detect. It is
>> supposedly the part of the drive where the manufacturers store their
>> information. Even reformatting the drive does not get rid of the
> infection.
>>
>> Are these claims even true? If so, do you know of any utilities to detect
>> and/or repair this type of virus or Trojan infection?
>>
>> Thank you!
>>
>> Gregg M. Hill
>>
>>
>
| 
XML site map