full-disclosure - NTRootkit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: zeroboy at arrakis.es (zero)
Subject: NTRootkit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all,
          I was wondering, if NTRootkit hooks syscalls, many of the current
programs used to detect running procs and hidden keys in register will
fail. So, how could you actually detect if syscalls have been hooked? I
belive you could see if new native calls have been added, but how can you
detect hooked and modified native calls?

Thxs in advance

www.citfi.org
www.podergeek.com
**********************************
"The further backward you look, the further forward you can see" Winston 
Churchill
"Access is GOD..."

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>

iQA/AwUBPvHnQw0R8jZM93x8EQIW+gCcCQc/N5j4wq6yjAiZi0bQsKYVMegAoI90
F2Zp7FOM8O0q3EeZHFLj7Rv6
=r6/w
-----END PGP SIGNATURE-----