![](https://csdnimg.cn/release/download_crawler_static/10032631/bg12.jpg)
Chapter 9: Dealing with a Lying, Cheating Operating System . . . . .231
Rooting Out Rootkits ...................................................................................232
Cleaning a network.............................................................................233
Before doing anything . . ...................................................................234
The best overall strategy ..................................................................234
Scanning Your OS from an External Medium............................................234
Microsoft WinPE .................................................................................235
Non-Microsoft bootable CDs.............................................................236
File-System Comparison from Full Boot to Safe Mode ............................238
Checkpointing Utilities with Offline Hash Databases..............................240
Verifying files with FileAlyzer............................................................240
Verifying file integrity with other utilities .......................................243
Rootkit-Detection Tools...............................................................................244
Autoruns: Aiding and abetting rootkit detection ...........................246
Rootkit Revealer .................................................................................247
F-Secure BlackLight Beta ...................................................................251
IceSword ..............................................................................................253
UnHackMe ...........................................................................................260
Malicious Software Removal Tool ....................................................261
AntiHookExec......................................................................................262
VICE......................................................................................................269
System Virginity Verifier (SVV).........................................................270
Strider GhostBuster ...........................................................................273
Rootkitty..............................................................................................274
RAIDE ...................................................................................................275
DarkSpy................................................................................................276
GMER....................................................................................................283
Detecting Keyloggers...................................................................................289
Types of keyloggers ...........................................................................289
Detecting keyloggers with IceSword................................................290
Detecting keyloggers with Process Explorer ..................................291
Tracking a RAT: Using Port Explorer to trace Netbus 1.60 ...........293
Part IV: Readying for Recovery ..................................301
Chapter 10: Infected! Coping with Collateral Damage . . . . . . . . . . . .303
Deciding What to Do if You’re Infected .....................................................303
Knowing when to give up and start from scratch..........................305
What happens when the patient can’t be saved ............................307
Do you want to track down the rootkit-er, or just recover?..........307
Taking measured action.....................................................................308
“My Computer Did What?!”.........................................................................310
Saving evidence to reduce your liability .........................................310
xvii
Table of Contents