RootKit Hook Analyzer

charlesvar · 2005/11/15

New: check for active kernel rootkits on your system

RootKit Hook Analyzer is a security tool which will check if there are any rootkits installed on your computer which hook the kernel system services. Kernel RootKit Hooks are installed modules which intercept the principal system services that all programs and the operating system rely on. If any of these system services are intercepted and modified it means that there is a possibility that the safety of your system is at risk and that spyware, viruses or malware are active.

Are kernel hooks always bad ?
Kernel hooks are out of fashion these days and not officially documented and considered deprecated by Microsoft. The pioneering heroes of the old days who discovered how to actually implement them have all adopted the new fashion of advising against using kernel hooks as a programming practice. Often kernel hooks are unnecessary because there are documented ways which allow a programmer to achieve his goal. However in a lot of system tools such as monitoring and antivirus software, kernel hooks are the only available technique to get the difficult job done and thus an unavoidable necessary evil. Important is that if your kernel system services are hooked that you can find out which is the responsible software that makes use of these techniques. Inspired by all the discussions going on about the Sony CD protection rootkit, we have developed the RootKit Hook Analyzer.

RootKit Hook Analyzer will tell you what kernel hooks are active on your system. It displays all kernel system services along with their base addresses, responsible modules as well as product names companies and module descriptions. If no hooks are active on your system it means that all system services are handled by NTOSKRNL.EXE, the principal base component of most Windows operating systems which is developed by Microsoft. All you have to do to find out what kernel hooks are installed on your system is press the Analyze button at the bottom of the screen. RootKit Hook Analyzer also allows you to view installed system modules and drivers with their base addresses as well as file and product information as well as the responsible companies.
Click to expand...

http://www.resplendence.com/hookanalyzer

Regards - Charles

PeteC · 2005/11/15

Interesting find, Charles ....

Kernel hooks are out of fashion these days and not officially documented and considered deprecated by Microsoft
Click to expand...

Not by eTrust (aka Zone Alarm) it would seem - 8 hooks, nor MS either - 1 hook - the recently released User Profile Hive Clean Up Service.

Incidentally UPHC has worked well on my m/c in eliminating Usernerv errors from Event Viewer.

charlesvar · 2005/11/15

Hi Pete,

With all this hullabaloo sorounding Sony, I became curious what processes or apps hooked on the kernel level.

Ditto for me with ZA.

PeteC said:

Incidentally UPHC has worked well on my m/c in eliminating Usernerv errors from Event Viewer.
Click to expand...

Thanks for the tip on UPHC

Regards - Charles

rebecca · 2005/11/16

PeteC said:

Incidentally UPHC has worked well on my m/c in eliminating Usernerv errors from Event Viewer.
Click to expand...

What are 'UPCH' and 'm/c', please?

Newt · 2005/11/16

UPHC - recently released User Profile Hive Cleanup

M/C is short-talk for a person's computer. Someone can say exactly but I seem to remember MicroComputer or My Computer or something similar as the origin of the term.

PeteC · 2005/11/17

m/c = machine

Must be my engineering background, but I use m/c as an abbreviation of 'machine' and tend to refer to computers as machines Apologies for any confusion out there!

What does m/c stand for?

Newt · 2005/11/17

Hmmmm.

pc = 2 letters and in positions most touch typist (even mediocre ones like me) can type easily.

m/c = 3 letters and the front slash is awkward unless you are really good.

Engineers are all about efficiency.

Pete, I really think that from a purely engineering standpoint, pc is probably better than m/c if writing about a personal computer.

PeteC · 2005/11/18

Log in or Sign up

RootKit Hook Analyzer

charlesvar Inactive Alumni Thread Starter

PeteC SuperGeek Staff

charlesvar Inactive Alumni Thread Starter

rebecca Well-Known Member

Newt Inactive

PeteC SuperGeek Staff

Newt Inactive

PeteC SuperGeek Staff

Share This Page

Log in or Sign up

RootKit Hook Analyzer

charlesvar Inactive Alumni Thread Starter

PeteC SuperGeek Staff

charlesvar Inactive Alumni Thread Starter

rebecca Well-Known Member

Newt Inactive

PeteC SuperGeek Staff

Newt Inactive

PeteC SuperGeek Staff

Share This Page

Useful Searches