[prev in list] [next in list] [prev in thread] [next in thread] 

List:       security-basics
Subject:    RE: rootkit behavior
From:       "dave kleiman" <dave () davekleiman ! com>
Date:       2006-07-27 19:15:25
Message-ID: 002801c6b1b1$056fab50$7201a8c0 () YOUVEBEENHACKED
[Download RAW message or body]



Have you taken a look at the RootKit Revelations help forum?

http://www.castlecops.com/f233-Rootkit_Revelations.html



    -----Original Message-----
    From: rainmann@sbcglobal.net [mailto:rainmann@sbcglobal.net] 
    Sent: Wednesday, July 26, 2006 00:11
    To: security-basics@securityfocus.com
    Subject: rootkit behavior
    
    Can a rootkit hide on a seperate physical disk from the 
    operating system? In other words, if WINNT is on c:\ can 
    the rootkit live on physically seperate data drives e:\ and 
    f:\?  I have a client who wants his c:\ drive reformatted 
    and reloaded to insure that no rogue program remains.  I 
    haven't been able to give him a definitive answer 
    concerning his extensive data drives.  Also, does anyone 
    know of any useful detection tools other than RootKit 
    Revealer and Blacklight? I saw the post the other day about 
    Helios but read that 1) it requires the .Net framework 
    (ouch!) and 2) doesn't work for Win2K.  Any advice here 
    would be greatly appreciated. 
    
    ------------------------------------------------------------
    ---------------
    This list is sponsored by: Norwich University
    
    EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE 
    The NSA has designated Norwich University a center of 
    Academic Excellence in Information Security. Our program 
    offers unparalleled Infosec management education and the 
    case study affords you unmatched consulting experience. 
    Using interactive e-Learning technology, you can earn this 
    esteemed degree, without disrupting your career or home life.
    
    http://www.msia.norwich.edu/secfocus
    ------------------------------------------------------------
    ---------------
    


---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------

[prev in list] [next in list] [prev in thread] [next in thread]