UBCD4Win Forums: dobbelina - Viewing Profile

As RootKitty still isn't working properly, I decided to make my own plugin called "Rootbabe".
My plugin has an added advantage, you can now scan both with md5 or without.
Scanning without md5 is extremely fast, and will tell you directly, if a file is hiding itself
from Windows.
Scanning with md5 is slow, but it will also tell you if any files has been changed, in addition
to hidden.

There are 5 scanning options:

1. Winscan-No-md5 (This is the scan you make in Windows, very fast)
2. PE-scan-No-md5 (This is the scan you make from PE, very fast)
3. Winscanmd5 (This is the scan you make in Windows, slow)
4. Pe-scanmd5 (This is the scan you make from PE, slow)
5. WinDiff Compare (This is the Microsoft utility you use to compare the scan files)

Once the scan 1 and 2, or 3 and 4 has been completed, compare with WinDiff.
Compare the "md5" scans separately from the "No-md5", don't mix.

All scan result files will end up in the root of C:.

The fsum.exe freeware utility is owned by © Copyright 1999-2004 SlavaSoft Inc.
http://www.slavasoft.com/ fsum/
I am not the author of this software.
All credits goes to the maker and copyright owner.

To install this plugin, simply extract the folder "Rootbabe" to the Malware folder inside your plugins,
and build the CD.

Download 143 kb: http://linkkings.bv2.net/ Rootbabe.zip

I cant make a new topic or reply in EzPCFix Support ?
Sorry, wont allow me ?

Quote

Wont get much feedback when it's like that...

Hi !
Nice tool this.
I could find a BartPe plugin for EzPcFix, but not for RootKitty ?
I'm a little bit confused.
The latest version of this proggie was released in 2006, but EzPcFix last build
was in 2005.(that has a rootkit scanner as a module).
Which of these 2 should I use ?
Perhaps RootKitty can be executed directly on the boot CD without any regentries.
The reason i'm asking is cause I wanna use it on a Reatogo build.
If I simply add a registry entry for it to show in XPE like this, it should work right ?
I mean, there are no dependencies and stuff ?

; RootKitty.inf
; PE Builder v3 plug-in INF file for RootKitty
; Created by Bart Lagerweij

[Version]
Signature= "$Windows NT$"

[PEBuilder]
Name="RootKitty"
Enable=1


[WinntDirectories]

a="Programs\RootKitty"
,2

[SourceDisksFiles]

RootKitty.exe=a,,1

[Software.AddReg]

0x2, "Sherpya\XPEinit\
Programs","Programs\
RootKitty","%SystemDrive%
\Programs\Rootkitty\
RootKitty.exe"

Or perhaps i'm better of just using the EzPcFix program, as I assume it's doing the same thing...

Another thing, I haven't seen anything at all, regarding people using it to successfully remove a rootkit.
Has it been done, and if so, what about the results ?