[pcuser]

I received an email from "Dave" (from here on our forum) suggesting that I add an MD5 check to each file. Here's the email:

Quote

I just wanted to make a suggestion about rootkitty. It might be a good feature to add an option for doing the md5 of each file that is listed. This will make it take quite a bit longer to run through the files, but could also catch files that wouldn't be caught otherwise. For example if a rootkit is redirecting you to an alernative file when you request it in the invfected OS, then it would be missed by your program. However, if you checked the MD5 on each you could see the file had changed when booted from the cd

So that's what I did. In addition to enumerating files, RootKitty now checks and records the MD5 hash for each file so it can compare the results.

The scan does take longer now (especially if you have alot of large files) but I think it's worth it.

I'm releasing it as beta so download it here for now:
http://www.ezpcfix.n.../RootKitty2.exe

Tom