For those who keep up on the developments there's nothing new here, but this is a very nice summary of the current state of rootkits as well as their detection. The first paper was written in May 2006 so includes recent creations such as RAIDE and ShadowWalker. The second series of papers is equally good and should also be considered mandatory reading for those interested in rootkit technology. Happy reading!


Inside Windows Rootkits
Chris Ries
http://www.vigilantminds.com/files/inside_windows_rootkits.pdf


Windows rootkits of 2005, parts 1-3
James Butler, Sherri Sparks
http://www.securityfocus.com/infocus/1850
http://www.securityfocus.com/infocus/1851
http://www.securityfocus.com/infocus/1854


Kayaker

nice job as alwasy... bye.. you alwasy post great articles and links...


bye

Thx for share.

Yes i agree,

especially the first article is interesting for the noobs in driver and ring0 stuff. It leads to a better understanding of the basics.
Would be glad to read more type of arcticles like this

Regards,

PAPiLLiON

Interesting paper, thanks