SECURITY OVERFLOW

FAQ pour l'exploit WMF (récent) Cette page est une simple traduction de la faq originale (I SC.SANS.org ). D'autres traductions de cette faq sont disponibles dans d'autres langues. * Pourquoi cette faille est si importante? La vulnérabilité WMF utilise...

ROOTKITS PREVENTION MEASURES: The more interesting method for avoiding rootkits or mitigating risks of infection is to apply prevention measures. Most of these methods requires to use only Windows as the first line defense. ***HARDEN WINDOWS: This step...

If we consider the IDS mantra ( "that which cannot be detected should be prevented; that which cannot be prevented should be detected."), prevention and detection countermeasures must be applied. A rootkit, much more than most other malwares, is a sign...

WINDOWS ROOTKIT DETECTION PART 2: ***Microsoft Tools: -Micosoft Removal Tool: It scans the system for the most prevalent malawares. HackerDefender is the only rootkit included on its database. If MRT detects easily the rootkit, the removal is not done...

Registry Tracking with RegMon: 2712 56.77157974 hxdef100.exe:448 OpenKey HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionshxdef100.exe NOT FOUND 2713 56.77293015 hxdef100.exe:448 OpenKey HKLMSystemCurrentControlSetControlTerminal...

HackerDefender is the rootkit that which is the most used in the wild. It was included in the threats list of the Microsoft Removal tool this year. HackerDefender or HxDef is the favourite rootkit of Script-Kiddies for many reasons: -light (199 ko for...

PRESENTATION: In this article, we'll try to provide free prevention and detection measures against the most common Windows rootkits. Currently, many effective free and paid anti-rootkits security softwares are available on the market, even if Windows...

All-SEEING Eye All -Seeing Eye is another Desktop Intrusion Prevention System designed to monitor several system's areas : -processes, -loading dlls, -services/drivers, -Browser Helper Objects (BHO), -ActiveX, -HostFile, -Winsock LSP, -registry keys,...

*Manage User Accounts and Apply policy restrictions. *Windows Rootkits Free Countermeasures: -Introduction to Rootkits, -HackerDefender in action, -Free Countermeasures. *HIPS test: 2 products. *An overview of HIPS based on white list. *Limitations of...

Sometimes an user can need to see what changes have been made by a software installation or to monitor some files and folders for suspect activity prevention. In this case, files monitoring softwares are very helpful. L'utilisateur a parfois besoin de...