UBCD4Win Forums: dobbelina - Viewing Profile

Ya, typo.
Easy to change.
Either re-classify the inf to Antivirus, or change the menus to the malware category,
whatever suits your mood:

<!-- Nu2Menu entry for Rootbabe-->
<NU2MENU>
        <MENU ID="Programs">

                <MITEM TYPE="POPUP" MENUID="Malware Tools">Malware Tools</MITEM>
        </MENU>
<MENU ID="Malware Tools">
                <MITEM TYPE="POPUP" MENUID="Rootbabe">
Rootbabe</MITEM>
        </MENU>
        <MENU ID="Rootbabe">

                <MITEM TYPE="ITEM" DISABLED="@Not(@FileExists(
@GetProgramDrive()\
Programs\rootbabe\
Winscanmd5.cmd))"
 CMD="RUN" FUNC="@GetProgramDrive(
)\Programs\rootbabe\
Winscanmd5.cmd">Winscanmd5<
/MITEM>
        </MENU>
<MENU ID="Rootbabe">

                <MITEM TYPE="ITEM" DISABLED="@Not(@FileExists(
@GetProgramDrive()\
Programs\rootbabe\
Pe-scanmd5.cmd))"
 CMD="RUN" FUNC="@GetProgramDrive(
)\Programs\rootbabe\
Pe-scanmd5.cmd">Pe-
scanmd5</MITEM>
</MENU>
<MENU ID="Rootbabe">

                <MITEM TYPE="ITEM" DISABLED="@Not(@FileExists(
@GetProgramDrive()\
Programs\rootbabe\
Winscan-No-md5.cmd))
" CMD="RUN" FUNC="@GetProgramDrive(
)\Programs\rootbabe\
Winscan-No-md5.cmd">
Winscan-No-md5</MITEM>

</MENU>
<MENU ID="Rootbabe">

                <MITEM TYPE="ITEM" DISABLED="@Not(@FileExists(
@GetProgramDrive()\
Programs\rootbabe\
PE-scan-No-md5.cmd))
" CMD="RUN" FUNC="@GetProgramDrive(
)\Programs\rootbabe\
PE-scan-No-md5.cmd">
PE-scan-No-md5</MITEM>

</MENU>
<MENU ID="Rootbabe">

                <MITEM TYPE="ITEM" DISABLED="@Not(@FileExists(
@GetProgramDrive()\
Programs\rootbabe\
WinDiff.Exe))" CMD="RUN" FUNC="@GetProgramDrive(
)\Programs\rootbabe\
WinDiff.Exe">WinDiff Compare</MITEM>
</MENU>
</NU2MENU>

Either way, it works in both cases

Ahh, I finally got it to work.
As Rootkitty still is in the "developing stage", I took the liberty to create an additional method that works similarly (unfortunately no md5's).
I've tried to simplify it as much as possible.
Here's how you do:
1. Download the Microsoft utility Windiff from here: http://www.grigsoft.com/ windiff.zip,
copy it to some location on your BootCD.

2. Open up your text editor and copy and paste the following:

dir /s /b /ah >scan1.txt
dir /s /b /a-h >>scan1.txt

Save the file as "Scan1.cmd"

3. Open up your text editor and copy and paste the following:

dir /s /b /ah >scan2.txt
dir /s /b /a-h >>scan2.txt

Save the file as "Scan2.cmd"

You now have 3 files,WinDiff.Exe, Scan1.cmd and Scan2.cmd

Copy Scan1.cmd and Scan2.cmd to the root of your C: drive.
Run Scan1.cmd.
When finished, boot into UBCD and run Scan2.cmd.
Compare with WinDiff.

I did some research and found there's a similar technique to yours finding rootkits:
http://searchwindows... et.co...1124935,00.html

Basically it goes like this:

Quote

Windiff is actually a small microsoft app.

I wonder, when I did the two "dir" from the command promt, it didn't list any of the files in my cookies folder (C:\Documents and Settings\Administrator\ Cookies), why is that ?, and
could you help me with a "correct" command line for this, so it really scans all the files.

Running windiff isn't a problem.

I'm still in no hurry, just wondering if there's been any progress ?

Thanks for that.