Rootkit - Revision history

BFeely: Revert major vandalism

2015-04-12T15:32:35Z

Revert major vandalism

Superlol103: Replaced content with "wOT IS A SCAM STOLE FROM WIKIPEDIA WE BUY LIKES AMD RUIN COMPANYS WE ARE PAID Kaspersky TDSSKiller ===Linux=== rkhunter"

2015-04-12T14:50:10Z

Replaced content with "wOT IS A SCAM STOLE FROM WIKIPEDIA WE BUY LIKES AMD RUIN COMPANYS WE ARE PAID *Kaspersky TDSSKiller ===Linux=== *rkhunter"

Nixiewot: And I forgot, RootkitRevealer is discontinued.

2012-02-12T21:41:00Z

And I forgot, RootkitRevealer is discontinued.

Nixiewot: Added TDSSKiller as a remover of Rootkits.

2012-02-12T12:18:54Z

Added TDSSKiller as a remover of Rootkits.

Joey66699912: /* Windows */

2010-12-09T01:07:00Z

‎Windows

Bob Zenith at 23:03, 11 April 2010

2010-04-11T23:03:14Z

Floracide: add moar

2009-10-06T12:17:18Z

add moar

G7w at 15:39, 4 October 2009

2009-10-04T15:39:18Z

G7w: Created page with 'A rootkit is a software system that consists of a program or combination of several programs designed to hide or obscure the fact that a system has been compromised. Contrary to …'

2009-10-04T15:35:24Z

Created page with 'A rootkit is a software system that consists of a program or combination of several programs designed to hide or obscure the fact that a system has been compromised. Contrary to …'

New page

A rootkit is a software system that consists of a program or combination of several programs designed to hide or obscure the fact that a system has been compromised. Contrary to what its name may imply, a rootkit does not grant a user administrator privileges, as it requires prior access to execute and tamper with system files and processes. An attacker may use a rootkit to replace vital system executables, which may then be used to hide processes and files the attacker has installed, along with the presence of the rootkit. Access to the hardware, e.g., the reset switch, is rarely required, as a rootkit is intended to seize control of the operating system. Typically, rootkits act to obscure their presence on the system through subversion or evasion of standard operating system security scan and surveillance mechanisms such as anti-virus or anti-spyware scan. Often, they are Trojans as well, thus fooling users into believing they are safe to run on their systems. Techniques used to accomplish this can include concealing running processes from monitoring programs, or hiding files or system data from the operating system.[1] Rootkits may also install a "back door" in a system by replacing the login mechanism (such as /bin/login) with an executable that accepts a secret login combination, which, in turn, allows an attacker to access the system, regardless of the changes to the actual accounts on the system.

Rootkits may have originated as regular applications, intended to take control of a failing or unresponsive system, but in recent years have been largely malware to help intruders gain access to systems while avoiding detection. Rootkits exist for a variety of operating systems, such as Microsoft Windows, Linux, Mac OS, and Solaris. Rootkits often modify parts of the operating system or install themselves as drivers or kernel modules, depending on the internal details of an operating system's mechanisms.

For more detailed information, please refer to the Wikipedia main entry for: [http://en.wikipedia.org/wiki/Rootkit Rootkit]

@@ Line 1: / Line 1: @@
-A Rootkit is a software system that consists of a program or combination of several programs designed to hide or obscure the fact that a system has been compromised. Contrary to what its name may imply, a Rootkit does not grant a user administrator privileges, as it requires prior access to execute and tamper with system files and processes. An attacker may use a Rootkit to replace vital system executables, which may then be used to hide processes and files the attacker has installed, along with the presence of the Rootkit. Access to the hardware, e.g., the reset switch, is rarely required, as a Rootkit is intended to seize control of the operating system. Typically, Rootkits act to obscure their presence on the system through subversion or evasion of standard operating system security scan and surveillance mechanisms such as anti-virus or anti-spyware scan. Often, they are [[Trojan Horse|Trojans]] as well, thus fooling users into believing they are safe to run on their systems. Techniques used to accomplish this can include concealing running processes from monitoring programs, or hiding files or system data from the operating system. Rootkits may also install a "[[Backdoor|back door]]" in a system by replacing the login mechanism (such as /bin/login) with an executable that accepts a secret login combination, which, in turn, allows an attacker to access the system, regardless of the changes to the actual accounts on the system.
+Rootkits are software systems that consists of program/s designed to hide or obscure the fact that a system has been compromised. Contrary to what its name may imply, a Rootkit does ''not'' grant a user administrator privileges, requiring prior access to execute and tamper with system files and processes. An attacker may use a Rootkit to replace vital system executables, which may then be used to hide processes and files the attacker has installed, along with the presence of the Rootkit. Access to the hardware, e.g., the reset switch, is rarely required, as a Rootkit is intended to seize control of the [http://en.wikipedia.org/wiki/Operating_system OS]. Typically, Rootkits act to obscure their presence on the system through subversion or evasion of standard operating system security scan and surveillance mechanisms such as anti-virus or anti-spyware scan. Often, they are [[Trojan Horse|Trojans]] as well, thus fooling users into believing they are safe to run on their systems. Techniques used to accomplish this can include concealing running processes from monitoring programs, or hiding files or system data from the operating system. Rootkits may also install a "[[Backdoor]]" in a system by replacing the login mechanism (such as /bin/login) with an executable that accepts a secret login combination, which, in turn, allows an attacker to access the system, regardless of the changes to the actual accounts on the system.
 Rootkits may have originated as regular applications, intended to take control of a failing or unresponsive system, but in recent years have been largely malware to help intruders gain access to systems while avoiding detection. Rootkits exist for a variety of operating systems, such as Microsoft Windows, Linux, Mac OS, and Solaris. Rootkits often modify parts of the operating system or install themselves as drivers or kernel modules, depending on the internal details of an operating system's mechanisms.
-For more detailed information, please refer to the Wikipedia main entry for: [http://en.wikipedia.org/wiki/Rootkit Rootkit]
+For more detailed information, please refer to the Wikipedia main entry for [http://en.wikipedia.org/wiki/Rootkit rootkits.]
 ==Removal/detection software==
@@ Line 9: / Line 9: @@
 *F-Secure BlackLight
 *RootkitRevealer
 ===Linux===
 *rkhunter

@@ Line 8: / Line 8: @@
 ===Windows===
 *F-Secure BlackLight
-*RookitRevealer
+*RootkitRevealer
 ===Linux===
 *rkhunter

← Older revision		Revision as of 23:03, 11 April 2010
Line 1:		Line 1:
−	A ~~rootkit~~ is a software system that consists of a program or combination of several programs designed to hide or obscure the fact that a system has been compromised. Contrary to what its name may imply, a ~~rootkit~~ does not grant a user administrator privileges, as it requires prior access to execute and tamper with system files and processes. An attacker may use a ~~rootkit~~ to replace vital system executables, which may then be used to hide processes and files the attacker has installed, along with the presence of the ~~rootkit~~. Access to the hardware, e.g., the reset switch, is rarely required, as a ~~rootkit~~ is intended to seize control of the operating system. Typically, ~~rootkits~~ act to obscure their presence on the system through subversion or evasion of standard operating system security scan and surveillance mechanisms such as anti-virus or anti-spyware scan. Often, they are Trojans as well, thus fooling users into believing they are safe to run on their systems. Techniques used to accomplish this can include concealing running processes from monitoring programs, or hiding files or system data from the operating system. Rootkits may also install a "back door" in a system by replacing the login mechanism (such as /bin/login) with an executable that accepts a secret login combination, which, in turn, allows an attacker to access the system, regardless of the changes to the actual accounts on the system.	+	A Rootkit is a software system that consists of a program or combination of several programs designed to hide or obscure the fact that a system has been compromised. Contrary to what its name may imply, a Rootkit does not grant a user administrator privileges, as it requires prior access to execute and tamper with system files and processes. An attacker may use a Rootkit to replace vital system executables, which may then be used to hide processes and files the attacker has installed, along with the presence of the Rootkit. Access to the hardware, e.g., the reset switch, is rarely required, as a Rootkit is intended to seize control of the operating system. Typically, Rootkits act to obscure their presence on the system through subversion or evasion of standard operating system security scan and surveillance mechanisms such as anti-virus or anti-spyware scan. Often, they are [[Trojan Horse\|Trojans]] as well, thus fooling users into believing they are safe to run on their systems. Techniques used to accomplish this can include concealing running processes from monitoring programs, or hiding files or system data from the operating system. Rootkits may also install a "[[Backdoor\|back door]]" in a system by replacing the login mechanism (such as /bin/login) with an executable that accepts a secret login combination, which, in turn, allows an attacker to access the system, regardless of the changes to the actual accounts on the system.

	Rootkits may have originated as regular applications, intended to take control of a failing or unresponsive system, but in recent years have been largely malware to help intruders gain access to systems while avoiding detection. Rootkits exist for a variety of operating systems, such as Microsoft Windows, Linux, Mac OS, and Solaris. Rootkits often modify parts of the operating system or install themselves as drivers or kernel modules, depending on the internal details of an operating system's mechanisms.		Rootkits may have originated as regular applications, intended to take control of a failing or unresponsive system, but in recent years have been largely malware to help intruders gain access to systems while avoiding detection. Rootkits exist for a variety of operating systems, such as Microsoft Windows, Linux, Mac OS, and Solaris. Rootkits often modify parts of the operating system or install themselves as drivers or kernel modules, depending on the internal details of an operating system's mechanisms.

← Older revision		Revision as of 12:17, 6 October 2009
Line 4:		Line 4:

	For more detailed information, please refer to the Wikipedia main entry for: [http://en.wikipedia.org/wiki/Rootkit Rootkit]		For more detailed information, please refer to the Wikipedia main entry for: [http://en.wikipedia.org/wiki/Rootkit Rootkit]
		+
		+	==Removal/detection software==
		+	===Windows===
		+	*F-Secure BlackLight
		+	*RookitRevealer
		+	===Linux===
		+	*rkhunter