rootkits

**myquitehead** · 12-08-2005, 09:36 AM

http://www.eweek.com/article2/0,1895,1887826,00.asp

"It's the equivalent of a big, bad guy turning up at your door, walking in and plopping down on your couch and refusing to leave. You're asking him to leave, pleading with him, screaming at him, and he just sits there and refuses to move. That's astonishing. It's really terrifying," Kaminsky added.

crazijoe · 12-08-2005, 10:38 AM

Another reason I use F-Secure

**40sondacurb** · 12-08-2005, 11:08 AM

how to see if you have a root kit,

Make a folder entitled $sys$text.txt and if it disappears then you have a rootkit on your hands.

I think that's the name of it but I can't be completely sure, I'll try and find the source.

**myquitehead** · 12-08-2005, 12:41 PM

What's the explanation for the dissappearance?

This is what I found:

"Try this. Make a file with notepad on your desktop called “test.txt” (no quotes). Change that filename to “$sys$text.txt” (again, no quotes). If it disappears, Sony’s screwed you."

**40sondacurb** · 12-08-2005, 01:16 PM

Quote:

Originally Posted by myquitehead

What's the explanation for the dissappearance?

This is what I found:

"Try this. Make a file with notepad on your desktop called “test.txt” (no quotes). Change that filename to “$sys$text.txt” (again, no quotes). If it disappears, Sony’s screwed you."

well the rootkit hides anything with the name $sys$text.txt I believe. You can actually use the rootkit to hide your stolen music from the rootkit.

**myquitehead** · 12-08-2005, 02:02 PM

Wow good one Sony, lol.

**DumberDrummer** · 12-08-2005, 03:43 PM

it hides anything, file or folder, with $sys$ prepended on the file name.

All clean here!

**Grove** · 12-09-2005, 01:24 AM

Likewise.

All Clean Here !!

elf · 12-09-2005, 12:44 PM

I was worried there for a minute, but it appears I'm clean too!

**Grove** · 12-09-2005, 05:20 PM

I haven't bought a Sony CD for a while and won't buy one either for a long time to come.

12-08-2005, 09:36 AM	#1 (permalink)
myquitehead TSF Enthusiast Join Date: Jun 2005 Posts: 572 OS: XP Pro Sp1	rootkits http://www.eweek.com/article2/0,1895,1887826,00.asp "It's the equivalent of a big, bad guy turning up at your door, walking in and plopping down on your couch and refusing to leave. You're asking him to leave, pleading with him, screaming at him, and he just sits there and refuses to move. That's astonishing. It's really terrifying," Kaminsky added.

12-08-2005, 10:38 AM	#2 (permalink)
crazijoe Registered User Join Date: Oct 2004 Location: Omaha, The Center of the Universe Posts: 7,632 OS: WinXP, Win2K3 My System	Another reason I use F-Secure __________________ Microsoft MCSA + Messaging, MVP, A+, Network+ http://i16.photobucket.com/albums/b3...other/Help.jpg Do you want a real Republican? HDD diagnostic tools / HDD data recovery software

12-08-2005, 11:08 AM	#3 (permalink)
40sondacurb Don't be a menace Join Date: Jan 2005 Posts: 6,285 OS: Vista sp2	how to see if you have a root kit, Make a folder entitled $sys$text.txt and if it disappears then you have a rootkit on your hands. I think that's the name of it but I can't be completely sure, I'll try and find the source. __________________ Donate to keep the forum running

12-08-2005, 12:41 PM	#4 (permalink)
myquitehead TSF Enthusiast Join Date: Jun 2005 Posts: 572 OS: XP Pro Sp1	What's the explanation for the dissappearance? This is what I found: "Try this. Make a file with notepad on your desktop called “test.txt” (no quotes). Change that filename to “$sys$text.txt” (again, no quotes). If it disappears, Sony’s screwed you." Last edited by myquitehead; 12-08-2005 at 12:44 PM.

12-08-2005, 03:43 PM	#7 (permalink)
DumberDrummer Cymru am byth Join Date: Oct 2003 Location: Oregon Posts: 5,385 OS: Windows XP Pro SP2 My System	it hides anything, file or folder, with $sys$ prepended on the file name. All clean here! __________________ Living with Louie dog's the only way to stay sane _____________________________________________ ... and with those words so begins my lifetime of longing for the devil's warm embrace

12-08-2005, 02:02 PM	#6 (permalink)
myquitehead TSF Enthusiast Join Date: Jun 2005 Posts: 572 OS: XP Pro Sp1	Wow good one Sony, lol.

12-09-2005, 01:24 AM	#8 (permalink)
Grove Professor/Moderator, TSF Design School Join Date: Jun 2005 Location: Australia Posts: 2,383 OS: Windows Vista SP2 32bit	Likewise. All Clean Here !! __________________ ========================================== Get Help: TSF Security Forum \| HijackThis \| MB's 5 Step Process Get Clean: AdAware SE \| Spybot S&D \| CWShredder \| Ewido \| CleanUp! Get Protected: SpywareBlaster \| SpywareGuard \| Windows Updates \| IE-SpyAd If TSF has helped you, please consider making a donation to help keep the board running.

12-09-2005, 12:44 PM	#9 (permalink)
elf Manager, Microsoft Support Join Date: Jul 2002 Location: Knoxville, TN or Austin, TX depending Posts: 7,038 OS: WinXP Pro SP3 and Windows 7 My System	I was worried there for a minute, but it appears I'm clean too! __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! I do not subscribe to threads, so if I stop replying, PM me with a link to your thread so I can find it again.

12-09-2005, 05:20 PM	#10 (permalink)
Grove Professor/Moderator, TSF Design School Join Date: Jun 2005 Location: Australia Posts: 2,383 OS: Windows Vista SP2 32bit	I haven't bought a Sony CD for a while and won't buy one either for a long time to come. __________________ ========================================== Get Help: TSF Security Forum \| HijackThis \| MB's 5 Step Process Get Clean: AdAware SE \| Spybot S&D \| CWShredder \| Ewido \| CleanUp! Get Protected: SpywareBlaster \| SpywareGuard \| Windows Updates \| IE-SpyAd If TSF has helped you, please consider making a donation to help keep the board running.