| |||||||||||||
Hunting for RootkitsHunting for RootkitsPosted Mar 1, 2007 5:55 UTC (Thu) by drag (subscriber, #31333)Parent article: Hunting for Rootkits
Not that I am a expert so take it for what it's worth...
It's also probably worth mentioning that these things are only usefull for _detecting_ rootkits.
Removing and disabling rootkits is another problem entirely.
In my opinion once you detect a rootkit, even if it's a stupid dinky one, that you should considure that paticular OS dead. It's not worth the time, effort, or uncertainty its going to take to clean that thing off.
Pull the plug on the computer (don't shutdown) take a image of the harddrive for safe keeping, format the drive and go on with your life.
(Log in to post comments)
Shutting down Posted Mar 8, 2007 23:53 UTC (Thu) by blujay (guest, #39961) [Link] Sometimes it might be a good idea to use the SysReq keys to remount partitions read-only, sync, and then shutdown or reboot. Since those commands go directly to the kernel, they would work unless the rootkit was on the kernel level, and might help prevent lost data.
They can also be helpful if X locks up your screen or keyboard.
|
|||||||||||||