Free rootkit detection software software for windows

McAfee Rootkit Detective will proactively detect and clean rootkits that are running on the system McAfee Rootkit Detective Beta is a program designed and developed by McAfee Avert Labs to proactively detect and clean rootkits that are running on the system.
McAfee Rootkit Detective should only be used by knowledgeable individuals at the direction of, and with the support of, a representative from McAfee Avert Labs or McAfee Technical Support. Improper usage of this tool could result in damage to your applications or operating system.
Main features:
- Designed to proactively detect the system objects like processes, files and registry that are hidden to the user
- Provides information about all running processes in the system
- Provides information about various system hooks like SSDT(System Service Descriptor Table) hooks, user/kernel IAT/EAT(Import/Export Address Table) hooks
- Allows the user to clean/remove the malicious objects from the system by renaming/deleting the hidden files/registry
- Allows the user to terminate the malicious processes
- Users can submit samples using the submission feature present in the tool
- Users can also collect the samples manually after renaming them and Avert Labs for further analysis
System requirements:
- Windows XP Home Edition with SP2
- Windows XP Professional Edition with SP2
- Windows 2000 with SP4
- Windows 2000 Server
- Windows 2003 Server SP1
BETA KNOWN ISSUES
- McAfee Rootkit Detective will detect registry entries pertaining to McAfee Entercept Products if installed on your system.
- McAfee Rootkit Detective will detect mfehidk.sys file pertaining to McAfee Antispyware Enterprise (Standalone) as a hooked service.
- McAfee Rootkit Detective will detect IAT/EAT hooks in Windows 2000 SP4 system pointing to shim.dll.
- McAfee Rootkit Detective will detect vsdatant.sys from Zone Alarm as hooked service for rootkit like behavior.
- McAfee Rootkit Detective will detect Goback2k.sys as hooked service on system having Go Back software installed system for rootkit like behavior.
- McAfee Rootkit Detective will detect fsndis5.sys as hooked service from F-Secure if F-Secure Internet Security Suite 2006 is installed on the system
- McAfee Rootkit Detective will detect klif.sys as hooked service from Kaspersky if Kaspersky Internet Security 2006 is installed on the system.
- McAfee Rootkit Detective will detect FireTDS.sys as hooked service from McAfee if McAfee Desktop Firewall is installed on the system.
- McAfee Rootkit Detective will detect Hidsys.sys as hooked service from McAfee if McAfee Host Intrusion Prevention is installed on the system.
- McAfee Rootkit Detective will detect Service Name ZwCreateThread when VSE product is installed on the system.
- McAfee Rootkit Detective will not run on Windows 2000 platforms when Kaspersky Internet Security 2006 is installed.
- McAfee Rootkit Detective will detect many IAT/EAT hooks and SSDT hooks of legitimate applications.

Sax2 Intrusion detection system(Free) 3.0 is an ideal program to protect intrusion. It performs real-time packet capturing, 24/7 network monitoring, advanced protocol analyzing and automatic expert detection. By giving you insights into all of your networks operations, Sax2 makes it easy to isolate and solve network problems, identify network bottleneck and bandwidth use, detect network vulnerabilities and discovered the network whether there is a breach of security strategy and the signs of being attacked in the network of hazard, and then intercept and stop before their invasion. Network administrators can directly monitor http requests, email messages, ftp transfers, as well as real-time activities and message details for the two popular instant messengers: MSN and QQ.

Sax2 is designed to be used by both IT professionals and novice users. Problems are clearly identified, and solutions are suggested in understandable terms. Whether you're a network administrator who needs to identify, diagnose, and solve network problems quickly, an IT professional who wants to monitor user activities on the network, a security manager who needs to ensure that the corporations communications assets are safe, or a consultant who has to quickly solve network problems for clients, Sax2 has the tools that you need.

Major Features:

1. Intrusion Detection and Prevention
2. Conduct of Audits
3. Traffic Statistics
4. Customize Security Policy
5. Real-Time Alert and Response

Rootkit Buster 1.6 is a tool equipped with the capability of scanning for hidden files, registry entries, processes, drivers and hooked system service. It also can clean hidden files and registry entries. It is free.

RootKit Hook Analyzer 3.02 helps you to avoid rootkits installed on your PC which hook the kernel system services. Kernel RootKit Hooks are installed modules that intercept the principal system services that all programs and the operating system rely on. Kernel hooks are out of fashion these days and not officially documented and considered deprecated by Microsoft. The pioneering heroes of the old days who discovered how to actually implement them have all adopted the new fashion of advising against using kernel hooks as a programming practice.

Often kernel hooks are unnecessary because there are documented ways that allow a programmer to achieve his goal. However in a lot of system tools such as monitoring and antivirus software, kernel hooks are the only available technique to get the difficult job done and thus an unavoidable necessary evil. Important is that if your kernel system services are hooked that you can find out which is the responsible software that makes use of these techniques. Inspired by all the discussions going on about the Sony CD protection rootkit, we have developed the RootKit Hook Analyzer.

Enhancements:

• Includes unspecified updates.