McAfee Rootkit Detective v1.0 - Rootkit偵測工具

McAfee表示，駭客通常透過Rootkit來藏匿惡意程式，這使得有駭客專門製造Rootkit並在黑市銷售，最經常透過Rootkit來藏匿的惡意程式為後門程式，而這些Rootkit通常伴隨在使用者不小心下載的木馬程式中，也有些廣告程式透過Rootkit來藏匿這些軟體。

根據McAfee所提供的數字，去年總計出現3284個Rootkit程式，但光是今年上半年發現的Rootkit程式就達到7325個。

Rootkit Detective是由McAfee旗下的Avert Labs所研發，可偵測個人電腦作業系統底層，並從中發現系統被人侵的蛛絲馬跡，例如使用者系統突然變慢或是有可疑的網路行為等。

McAfee表示，Rootkit Detective可察覺潛在的系統執行程序、註冊登錄及檔案，以讓使用者可安全移除或關閉這些惡意活動，此外，Rootkit Detective也可掃描個人電腦的核心記憶體並顯示任何的修改，以讓使用者了解系統是否被入侵。

McAfee Rootkit Detective 1.0 is a program designed and developed by McAfee Avert Labs to proactively detect and clean rootkits that are running on the system.

McAfee Rootkit Detective should only be used by knowledgeable individuals at the direction of, and with the support of, a representative from McAfee Avert Labs or McAfee Technical Support. Improper usage of this tool could result in damage to your applications or operating system.
Download it

Features
Following are the features of this program that are designed to proactively detect and clean rootkits from the system. This program is not dependent on any signatures and can proactively detect most of the existing and upcoming rootkits and allow the user to clean them.

* Designed to proactively detect the system objects like processes, files and registry that are hidden to the user.
* Provides information about all running processes in the system.
* Provides information about various system hooks like SSDT(System Service Descriptor Table) hooks, user/kernel IAT/EAT(Import/Export Address Table) hooks.
* Allows the user to clean/remove the malicious objects from the system by renaming/deleting the hidden files/registry.
* Allows the user to terminate the malicious processes.
* Users can submit samples using the submission feature present in the tool.
* Users can also collect the samples manually after renaming them and submit to [email protected] for further analysis.

Rootkit Detective log file contains details of the hidden files. The files once renamed after reboot will have a .REN extension. User can search for the same on the system and can submit these files for further analysis with your comments to [email protected]. Zip the files and password protect with “infected” and mention “Rootkit Detective” in the subject line when you send the mail.
Supported Operating Systems

* Windows XP Home Edition with SP2
* Windows XP Professional Edition with SP2
* Windows 2000 with SP4
* Windows 2000 Server
* Windows 2003 Server SP1

http://vil.nai.com/vil/stinger/rkstinger.aspx
http://www.ithome.com.tw/itadm/article.php?c=44557