RootkitRevealer for Windows – Fast Download with No Registration

Display Captures

RootkitRevealer is an advanced rootkit detection efficiency. It performs beside Windows NT 4 and above and its output indexes Registry and file system API discrepancies the one might indicate such presence featuring a user-mode or kernel-mode rootkit.

RootkitRevealer successfully detects many persistent rootkits for instance AFX, Vanquish and HackerDefender (note: RootkitRevealer is not intended to detect rootkits like Fu these ones don't attempt to hide their files or registry keys).

Since persistent rootkits work by changing INTEGRATION INTERFACE results so as a system view using APIs differs from the actual view in storage, RootkitRevealer compares the results of a system scan over the loftiest extent with those at each lowest step. The highest level defines the Windows API and the lowest degree is the raw contents of single file system volume or Roster hive (a hive file operates any Registry's on-disk storage format).

Thus, hacking tools, whether user mode or kernel mode, that manipulate the Lenses API or native API to remove their involvement from a directory listing, concerning template, will exist seen by RootkitRevealer as individual discrepancy between the information came back around by the Windows API and this one noted in the raw scan of a FAT on the other hand NTFS volume's file system structures.