Remember that you can never trust a compromised machine. You may think you found all signs of a rootkit, but the attacker may have created backdoors in other places. Non-standard backdoors that tools you use won't detect. As a rule you should reinstall a compromised machine from scratch.
- 编辑 - 还有 Windows 工具。 但我描述了我熟悉的工具，它们是免费的并且有更好的文档记录。
SysInternals stopped updating RootKit Revealer a couple of years ago.
The only sure way to detect a rootkit is to do an offline compare of installed files and filesystem metadata from a trusted list of known files and their parameters. Obviously, you need to trust the machine you are running the comparison from.
In most situations, using a boot cdrom to run a virus scanner does the trick, for most people.
Otherwise, you can start with a fresh install of whatever, boot it from cdrom, attach an external drive, run a perl script to find and gather parameters (size, md5, sha1), then store the parameters.
To check, run a perl script to find and gather parameters, then compare them to the stored ones.
Also, you'd need a perl script to update your stored parameters after a system update.
--Edit-- Updating this to reflect available techniques. If you get a copy of any bootable rescue cd (such as trinity or rescuecd) with an up-to-date copy of the program "chntpasswd", you'll be able to browse and edit the windows registry offline.
Coupled with a copy of the startup list from castlecops.com, you should be able to track down the most common run points for the most common rootkits. And always keep track of your driver files and what the good versions are too.
With that level of control, your biggest problem will be the mess of spaghetti your registry is left in after you delete the rootkit and trojans. Usually.
-- Edit -- and there are windows tools, too. But I described the tools I'm familiar with, and which are free and better documented.
发布评论
评论（3）
来自 SysInternals 的 Rootkit 揭示者
Rootkit revealer from SysInternals
请记住，您永远不能信任受感染的机器。 您可能认为您找到了 Rootkit 的所有迹象，但攻击者可能在其他地方创建了后门。 您使用的工具无法检测到的非标准后门。 通常，您应该从头开始重新安装受感染的计算机。
Remember that you can never trust a compromised machine. You may think you found all signs of a rootkit, but the attacker may have created backdoors in other places. Non-standard backdoors that tools you use won't detect. As a rule you should reinstall a compromised machine from scratch.
SysInternals 几年前停止更新 RootKit Revealer。
检测 Rootkit 的唯一可靠方法是对已知文件及其参数的可信列表中的已安装文件和文件系统元数据进行离线比较。 显然，您需要信任运行比较的机器。
在大多数情况下，对于大多数人来说，使用启动 CDROM 来运行病毒扫描程序就可以解决问题。
否则，您可以从全新安装任何东西开始，从 cdrom 启动它，连接外部驱动器，运行 perl 脚本来查找和收集参数（大小、md5、sha1），然后存储参数。
要进行检查，请运行 perl 脚本来查找和收集参数，然后将它们与存储的参数进行比较。
此外，您还需要一个 perl 脚本来在系统更新后更新存储的参数。
- 编辑 -
更新此内容以反映可用的技术。 如果您获得带有程序“chntpasswd”的最新副本的任何可启动救援CD（例如trinity或rescuecd）的副本，您将能够离线浏览和编辑Windows注册表。
结合来自 castlecops.com 的启动列表副本，您应该能够追踪最常见 Rootkit 的最常见运行点。 并始终跟踪您的驱动程序文件以及好的版本。
有了这种程度的控制，您最大的问题将是删除 rootkit 和特洛伊木马后，注册表中留下的一团乱麻。 通常。
- 编辑 -
还有 Windows 工具。 但我描述了我熟悉的工具，它们是免费的并且有更好的文档记录。
SysInternals stopped updating RootKit Revealer a couple of years ago.
The only sure way to detect a rootkit is to do an offline compare of installed files and filesystem metadata from a trusted list of known files and their parameters. Obviously, you need to trust the machine you are running the comparison from.
In most situations, using a boot cdrom to run a virus scanner does the trick, for most people.
Otherwise, you can start with a fresh install of whatever, boot it from cdrom, attach an external drive, run a perl script to find and gather parameters (size, md5, sha1), then store the parameters.
To check, run a perl script to find and gather parameters, then compare them to the stored ones.
Also, you'd need a perl script to update your stored parameters after a system update.
--Edit--
Updating this to reflect available techniques. If you get a copy of any bootable rescue cd (such as trinity or rescuecd) with an up-to-date copy of the program "chntpasswd", you'll be able to browse and edit the windows registry offline.
Coupled with a copy of the startup list from castlecops.com, you should be able to track down the most common run points for the most common rootkits. And always keep track of your driver files and what the good versions are too.
With that level of control, your biggest problem will be the mess of spaghetti your registry is left in after you delete the rootkit and trojans. Usually.
-- Edit --
and there are windows tools, too. But I described the tools I'm familiar with, and which are free and better documented.