[pcuser]

I just released a new version of RootKitty that has a much faster scanning engine than any previous version. It also now has an option to not hash files larger than the filesize that you specify, this is handy if you have a folder filled with 700 iso files that you don't need to include in the scan.

You can download the new version from HERE

Tom

[DigiWiz]

OK, let's get one thing out of the way - I didn't read the instructions (I'm not sure if there are any).

It is indeed lightning fast - what it seems to do is generate and md5 hash for C:\ drive. I'm not sure what the difference is for the Win-scan and PE-scan buttons - but my guess would be they're to be chosen depending on what OS you're in (Windows or PE)... but all my other md5 apps don't need to differentiate, so I'm confused as to what purpose the buttons serve.

I'm also a little confused about the buttons - there's no way to stop the process unless I click Close - maybe Start Stop and Continue buttons would be helpful?

I guess i need to know more about what it's "supposed" to do before I comment further...

[pcuser]

RootKitty scans your hard drive from within windows (WinScan) and generates a file listing of all files along with the md5 hash then you boot to a PE environment and click PeScan. When it's finished scanning then you click "Compare" and it'll compare the 2 files to determine if any files were stealthing themselves from windows or have been changed. By default it scans the entire C:\ drive but you can change it to any path/drive that you want.

[The Piney]

I'm getting a "Run-time error '9': Subscript out of range... I checked the files and the PE-files.txt is 0 Kb. Anyone else having any problems with the update.. I'm going to re-download and try again just to check...

[pcuser]

I found a couple of things that need to be addressed under certain conditions so don't download it until I post back.

[heatmizer]

pcuser.
I would just like to say Thank You for all your work.

This post has been edited by heatmizer: 27 August 2006 - 10:30 PM

[smiley]

pcuser, on Aug 26 2006, 09:27 PM, said:

By default it scans the entire C:\ drive but you can change it to any path/drive that you want.

Just a hint:
It is possible that the drive letter changes between PE and Win,
so it should not be part of the comparison.

[dobbelina]

The Piney, on Aug 26 2006, 11:11 PM, said:

I'm getting a "Run-time error '9': Subscript out of range... I checked the files and the PE-files.txt is 0 Kb. Anyone else having any problems with the update.. I'm going to re-download and try again just to check...

I get the exact same error message.
The winscan works fine, but not the PE one ?

[dobbelina]

Here's a follow up.
Today I tried changing to the 1.08 version, but are still receiving the
"Run-time error '9': Subscript out of range... I" error message.
This time the Win-PE file was actually created, but when clicking "compare" I got the error
message above.
Interesting to note is what the Win-PE file says, here's a short draft from the beginning:

C:\CONFIG.SYS, d41d8cd98f00b204e9800998ecf8427e
C:\CLASSES.1ST, c6394338847a6dc11436da08350d34d8
C:\hunt.;-D, 9054ab98f3d9f9b4573240a33b3a43e0
C:\WINDOWS, B:\\md5sum.exe: WINDOWS: Permiss
C:\MSDOS.SYS, 4de66ebdb23fcf3d0b8f7e5a49229c57
C:\hunt.;-o, e589f101a8195f6dd67dabc82c133225
C:\AUTOEXEC.BAK, 1f82e049e51a327c2b5086310a6d207f
C:\pagefile.sys, 31122f8ef8abb659e93e9cbace6787ab
C:\CONFIG.BAK, d41d8cd98f00b204e9800998ecf8427e
C:\SCANDISK.LOG, c313819b823ddc7135a98bdcc0b38347
C:\Drivers, B:\\md5sum.exe: Drivers: Permiss
C:\io.sys, 1a6e48b32f58d5d086ea939f9b64cb27
C:\Program Files, B:\\md5sum.exe: Program Files: P
C:\Auth.prof, 39181eabb0e4ca1e8b7bf7b3c3a1defe
C:\Windows Update Setup Files, B:\\md5sum.exe: Windows Update S
C:\Win-Files.txt, 81b01676f48af3d3b09f255e10b8088e
C:\agame, B:\\md5sum.exe: agame: Permissio
C:\G723_LT.DLL, 1978b65799898b4d697070c7880b0190
C:\Command & Conquer 2, B:\\md5sum.exe: Command & Conque
C:\Beachhead2000, B:\\md5sum.exe: Beachhead2000: P
C:\Bubble 2, B:\\md5sum.exe: Bubble 2: Permis
C:\House of the dead, B:\\md5sum.exe: House of the dea
C:\LiveWire, B:\\md5sum.exe: LiveWire: Permis
C:\Marble, B:\\md5sum.exe: Marble: Permissi
C:\RockmanX 4, B:\\md5sum.exe: RockmanX 4: Perm

What is this md5sum.exe...permission that it keeps referring to ?
I do not have that one my ram drive, (The B: drive)
My CD is built from a Reatogo package, maybe that's why something is missing ?

The Win-windows scan file looks exactly like the one above, but with no
mentioning of "md5sum.exe".
It's "clean", with all the checksums listed behind the filenames ?
Please, gimme a hint on what's wrong.
I really would like to use this proggie.

[dobbelina]

Maybe I should mention also, the first time I ran RootKitty (v1.09), it was not from the ram drive. It's was simply executed from the CD.
The second time when I used v1.08, I ran it from the C: drive.
The RootKitty's own logfile is always empty, I never seen it pick up anything either ?

[SteelTrepid]

I assume your issues all revolve around the use of reatogo. While we try to make our plugins and tools universal for any or all BPE builds, we can only do so much. Please understand that our focus is of course on this project and we do not have and will not spend extra time making sure our tools are completely compatible with "others."

<<personal opinion time>>
Sorry, but I must. I'd just like to mention a few facts. Sure, reatogo is fine if you really must use a more XP like interface.....fine if that is what you want. If you want a faster booting CD that still looks good and is pre-packed with the tools you want, then it's UBCD4Win. If you want a dedicated forum with fast and good support, then you need UBCD4Win. If you want good tools developed for BPE (with several Development team members that are programmers and can do it), then you need UBCD4Win.

[pcuser]

@dobbelina
Please don't PM me to tell me to respond to a thread. I read all posts in this forum and respond to them as time permits.

I really do appreciate the feedback on RootKitty but I'm strapped for time right now and don't have time to fix it.

I'm honestly not trying to be an ass but I bought a house this year that needed major work. The ceiling in the living room was falling down because of water damage from a very leaky roof so we tore it all down and gutted it out completely. My wife recently asked me where we were going to setup the Christmas tree? I told her that the livingroom would be finished by Christmas and not to worry.

RootKitty is very important to me and your feedback is very important but it'll be a couple of weeks before I can address your issues directly.

Tom

[dobbelina]

No problem, I'm not in that kinda hurry.
Just wanted you to get the feedback, as I know it will improve later releases.
Nice to see you got yourself a house, just love those mortgages
Seems to me you're the "do it" kinda guy, should be perfect then...he he

Now to more serious matters,(Not really),

Today I installed ubcd v3(Latest), and built a CD from an clean sp2 source.
No changes has been made to the "original" setup, except for updating virus scanners/definitions.
I also updated the v1.07 RootKitty (that's in the original v3 package) to 1.09.

I'm sorry to say,like before, the "PE-Files.txt" is only a 0kb file after the PE scan is done.
So it doesn't make any difference wether it's built from Reatogo or ubcd.

The target system that i'm testing on is a 20 gigabyte Fat32 partition (Drive C:).

I hope this additional info can put you on the right track when de-bugging.

I'll be popping by from time to time to see if there's any progress.

Good luck with your renovation and merry christmas to you !

This post has been edited by rdsok: 08 December 2006 - 04:16 AM
Reason for edit:: removed extra line feeds

[dobbelina]

I'm still in no hurry, just wondering if there's been any progress ?

[dobbelina]

I did some research and found there's a similar technique to yours finding rootkits:
http://searchwindows...et.co...1124935,00.html

Basically it goes like this:

Quote

Run "dir /s /b /ah" and "dir /s /b /a-h" on the system drive from inside the suspect operating system.
Save the results.
Boot into a clean CD (such as WinPE).
Run "dir /s /b /ah" and "dir /s /b /a-h" on the system drive of the suspect computer.
Save the results.
Launch WinDiff from the CD, compare the two sets of results to detect file-hiding malware (i.e., invisible inside, but visible from outside).
There will be some false positives -- for example, legitimate temporary files from the operating system and applications will show up.

Windiff is actually a small microsoft app.

I wonder, when I did the two "dir" from the command promt, it didn't list any of the files in my cookies folder (C:\Documents and Settings\Administrator\Cookies), why is that ?, and
could you help me with a "correct" command line for this, so it really scans all the files.

Running windiff isn't a problem.

This post has been edited by dobbelina: 23 January 2007 - 12:48 AM