RootkitRevealer

RootkitRevealer, shown in Figure A-8, is a single-button rootkit detector. Just press the Scan button and read the output. System anomalies are displayed sequentially as they are found, and the Description column can usually help to determine the root cause of the anomaly.

Figure A-8

RootkitRevealer checks the file system and the registry using both high-level system calls and low-level parsing. Any discrepancy between these scans will be displayed.

As Sysinternals was recently acquired by Microsoft, and Microsoft is currently developing the Strider Ghostbuster rootkit detector, RootkitRevealer is expected to become part of Strider Ghostbuster internals.