Sophos Anti-Rootkit

Free rootkit detection and removal tool 

Download now

Rootkit scanning, detection and removal

Our free software, Sophos Anti-Rootkit scans, detects and removes any rootkit that is hidden on your computer using advanced rootkit detection technology.
Rootkits can lie hidden on computers and remain undetected by antivirus software. Although new rootkits can be prevented from infecting the system, if you had any rootkits before you installed your antivirus, they may never be revealed.
Removing rootkits without compromising system integrity is particularly challenging and needs to be done with care.

Simplified management

Using Sophos Anti-Rootkit is easy. Whether you use its simple graphical user interface or run it from the command line, you can easily detect and remove any rootkits on your computer.

Easy to use

Sophos Anti-Rootkit provides an extra layer of protection, by safely and reliably detecting and removing any rootkit that might have hidden itself on your system.

Stay free of rootkits

As part of its complete protection of endpoint computers, Sophos Endpoint Security and Data Protection has an integrated detection functionality that removes and prevents them being installed onto your desktops, laptops and servers.

System requirements

Sophos Anti-Rootkit will support the following operating systems:

• Windows 2000
• Windows XP
• Windows Vista
• Windows 7
• Windows Server 2003
• Windows Server 2008
• 64-bit platforms

Sophos Anti-Rootkit requires a minimum of 128 Mb RAM.

Read More

Windows Rootkits

Windows Rootkits are a big rarity in this modern web hacking tehnology…
I won’t speak exactly about rootkits, because it’s impropriate to call them that way… why? Well rootkits are programs that aid you in getting access to root level users…

So in the case we are using Windows rootkits we should call them admkits. So let’s cut the **** and get down to serious business.

Note: the following admkits are from www.packetstormsecurity.org, there also could be others available on the net… not just the following 4
_ROOT_040

Windows NT Rootkit v0.04 alpha – Hides processes, files, directories, has k-mode shell using TCP/IP – you can telnet into rootkit from remote. Hides registry keys – (keyboard patch disabled in this build.) Includes execution redirection.

Fake Netstat

Fake Netstat is a windows copy of netstat which can hide certain network connections. Requires renaming the original netstat.

NT BindShell

Ntbindshell is a lightweight (24k compiled) cmd.exe backdoor for Windows. Full C source included. Provides two modes of operation – standard (listening mode) or reverse-connect mode. Includes the ability to install itself as a system service, providing a shell with LocalSystem privileges.

reverseTelnet

Reverse telnet redirector / port redirector and front end console for Windows. Perfect for firewall bypassing from inside out. Can be used for bouncing connections, piping or relaying data, or as a quick MIM chat server. Windows executable form only.

More information of course can be found in the readme files from the archive…

Read More