[dobbelina]

Hi !
Nice tool this.
I could find a BartPe plugin for EzPcFix, but not for RootKitty ?
I'm a little bit confused.
The latest version of this proggie was released in 2006, but EzPcFix last build
was in 2005.(that has a rootkit scanner as a module).
Which of these 2 should I use ?
Perhaps RootKitty can be executed directly on the boot CD without any regentries.
The reason i'm asking is cause I wanna use it on a Reatogo build.
If I simply add a registry entry for it to show in XPE like this, it should work right ?
I mean, there are no dependencies and stuff ?

; RootKitty.inf
; PE Builder v3 plug-in INF file for RootKitty
; Created by Bart Lagerweij

[Version]
Signature= "$Windows NT$"

[PEBuilder]
Name="RootKitty"
Enable=1


[WinntDirectories]
a="Programs\RootKitty",2

[SourceDisksFiles]
RootKitty.exe=a,,1

[Software.AddReg]

0x2, "Sherpya\XPEinit\Programs","Programs\RootKitty","%SystemDrive%\Programs\Rootkitty\RootKitty.exe"

Or perhaps i'm better of just using the EzPcFix program, as I assume it's doing the same thing...

Another thing, I haven't seen anything at all, regarding people using it to successfully remove a rootkit.
Has it been done, and if so, what about the results ?

This post has been edited by dobbelina: 04 December 2006 - 03:55 AM

[pcuser]

Sorry for the late reply but I was swamped all day at work today.

The stand alone version of RootKitty is much newer than the version included in the 1.0.0.16 release of ExPcFix. In addition to scanning much faster, it also compares the MD5 hash of each file to determine if it's been modified. Be warned though that I've recieved very little feedback on the latest version of RootKitty so please post back it you notice anything that needs changed or fixed.

Quote

Another thing, I haven't seen anything at all, regarding people using it to successfully remove a rootkit.
Has it been done, and if so, what about the results ?

Yes, I use it all the time. You can test the logic by running it from within Windows and then boot to PE and create a new file and run it again then compare the results. Or... If you have a sample rootkit handy

Quote

If I simply add a registry entry for it to show in XPE like this, it should work right ?

It also requires VB6 runtime support (msvbvm60.dll).

BTW. As soon as I have time to wrap up a few loose ends, I'll be releasing a long overdue updated EzPcFix that includes the latest RootKitty.

Tom

[dobbelina]

Ok, many thanks for your replies.
I just tested rootkitty in my Reatogo build, work just fine.
Ok, i'll stay with the standalone RootKitty for now.
Looking forward to see the latest build incorporated into EzPcFix to.