-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I was wondering, if NTRootkit hooks syscalls, many of the current programs used to detect running procs and hidden keys in register will fail. So, how could you actually detect if syscalls have been hooked? I belive you could see if new native calls have been added, but how can you detect hooked and modified native calls?
Thxs in advance www.citfi.org www.podergeek.com ********************************** "The further backward you look, the further forward you can see" Winston Churchill "Access is GOD..." -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBPvHnQw0R8jZM93x8EQIW+gCcCQc/N5j4wq6yjAiZi0bQsKYVMegAoI90 F2Zp7FOM8O0q3EeZHFLj7Rv6 =r6/w -----END PGP SIGNATURE----- --------------------------------------------------------------------------- Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! The Gartner Group just put Neoteris in the top of its Magic Quadrant, while InStat has confirmed Neoteris as the leader in marketshare. Find out why, and see how you can get plug-n-play secure remote access in about an hour, with no client, server changes, or ongoing maintenance. Visit us at: http://www.neoteris.com/promos/sf-6-9.htm ----------------------------------------------------------------------------