** RootKit Detection + Prevention ! **

Foundstone provide many fine Free tools, and in The Forensic ToolkitTM v2.0 are 2 that will assist you in finding hidden files. That doesn't automatically mean Rootkits of course, but non the less very useful Apps to have in your armament against Stealthy hiding items.

HFind scans the disk for hidden files. It will find files that have either the hidden attribute set, or NT's unique and painful way of hiding things by using the directory/system attribute combination. This is the method that IE uses to hide data. HFind lists the last access times.
 
SFind scans the disk for hidden data streams and lists the last access times. 

http://www.foundstone.com/index.htm?subnav=resources/navigat ion.htm&subcontent=/resources/freetools.htm

Spanner

More Tools to assist in the search for Hidden files etc + a couple of specific Rootkit/Sleath seeking Apps. All are FREE except for HF, but you can download and try it before you buy. Have fun !

HiddenFinder

http://www.wenpoint.com/product/hiddenfinder.html

DetectProc - Detect Hidden Processes

http://www.kd-team.com

Hidden service detector

https://www.rootkit.com/newsread.php?newsid=423

Unhide

http://www.security-projects.com/?Unhide

-

RootKit Hook Analyzer

http://www.resplendence.com/hookanalyzer

System Virginity Verifier

http://invisiblethings.org/

Spanner

Just released today is a 1.53Mb PPT available for DL on the RAIDE = Rootkit Analysis Identification Elimination tool, that i previewed in here on page 1 in January.

Peter Silberman has been working in computer security field for a number of years, specializing in rootkits, reverse engineering and automated auditing solutions. Peter was previously employed at HBGary.

Jamie Butler author of Rootkits: Subverting the Windows Kernel, and former Director of Engineering at HBGary Inc. is now involved with Copilot: A high assurance integrity monitor - www.komoku.com/technology.shtml

RAIDE: By: petersilberman

In Amsterdam Jamie Butler and I presented on a tool we have been developing called Rootkit Analysis Identification Elimination (RAIDE). I have put the slides in my vault and a public version of RAIDE Beta will be made available in the coming weeks. I am looking for final beta testers on all windows platforms from 2k - 2k3 to do tests with RAIDE. If you are interested e-mail me at peter {_[_dot_]_} silberman {_[_at_]_} gmail {_[_dot_]_} com

Thanks Peter~

http://www.rootkit.com

Also something very interesting is this -

SubVirt: Implementing malware with virtual machines

Attackers and defenders of computer systems both strive to gain complete control over the system. To maximize their control, both attackers and defenders have migrated to low-level, operating system code. In this paper, we assume the perspective of the attacker, who is trying to run malicious software and avoid de- tection. By assuming this perspective, we hope to help defenders understand and defend against the threat posed by a new class of rootkits.

We evaluate a new type of malicious software that gains qualitatively more control over a system. This new type of malware, which we call a virtual-machine based rootkit (VMBR), installs a virtual-machine mon-itor underneath an existing operating system and hoists the original operating system into a virtual machine.

etc etc

PDF 204 Kb paper here - http://www.astalavista.com/index.php?section=directory&c md=detail&id=6365

Spanner

2 additions to include 4 U -

-

zeppoo

07.03.06 Zeppoo-0.0.2 is available.

A new option has been added! Zeppoo can check the Interrupt Descriptor Table

01.03.6 Zeppoo v0.0.1

This is the first release of Zeppoo!!

This software allows you to detect rootkits on i386 architecture under Linux, by using /dev/kmem and /dev/mem.
Moreover it can detect hidden tasks, connections, corrupted symbols, system calls ... and so many other things.
Currently all the existing rootkits don't use these methods and can be easily hacked.
At this time you can only download the Python's version of Zeppoo, but the C version will be avaible in few days.
In addition, by visiting the website you will find all necessary informations to use it. However if you have any problems,please feel free to contact us with them.

Free - http://www.zeppoo.net/ -

They are very interested in porting it over to Windows, so if you can offer any assistance then get touch !

-

RootKitty

RootKitty is a very simple utility that makes a file listing when running from windows and a file listing from PE/ubcd4win then compares the two files and shows you the differences (looking for rootkits).

Can detect and delete.

Saves a log.

It doesn't scan for hidden registry entries (yet) but he's working on it.

Free - http://www.ubcd4win.com/forum/index.php?s=b2064cb601a4694c6a 7f4abe10422d54&showtopic=2424

-

Spanner

The latest version of IceSword is out and available for download right now. 1.16 enhances a few functions to detect rootkits.

The help file is still in Chinese, so referring to previous versions HF should be useful. If anyone can translate both of the new HF to English it would be welcomed by the author. The email address is included for you in the ReadMe text file.

IceSword 1.16 English version for Windows 2000/XP/2003

http://www.xfocus.net/tools/200604/1156.html

ftp://202.38.76.151/pub2/Kernel/Windows/tools/IceSword116.ra r

Spanner