Detect the "Undetected"..."ALARM..ALARM"

Hi folks..!! Its been days i havenot feed in some security relates articles and so,here i come with a security post...!!



Most of you must be aware of the terms like virus,trojan,spyware,adware and worms..!!
How about a RootKit??

1.What is A RootKit??

A rootkit is a software system that consists of a program, or combination of several programs, designed to hide or obscure the fact that a system has been compromised.

A rootkit also allows someone, either legitimate or malicious, to maintain control over a computer system, without the computer user(Admin/Non Admin) knowing about it. Rootkits are the toughest malware to detect because they often fools the users to believe they are safe and install themselves as drivers or kernel modules.



Rootkits may have originated as regular applications, intended to take control of a failing or unresponsive system, but in recent years have been largely malware to help intruders gain access to systems while avoiding detection.

Rootkits find their existance on operating systems, such as Microsoft Windows, Linux, Mac OS, and Solaris. Rootkits often can modify parts of the operating system or install themselves as drivers or kernel modules, depending on the internal details of an operating system's mechanisms


2.Types of RootKits??

[A}Hardware/Firmware Level

A firmware rootkit uses device or platform firmware to create a persistent malware image. The rootkit can successfully hide in the firmware, because firmware is not often inspected for code integrity.

[B] Persistent/Hypervisor level

These rootkits work by modifying the boot sequence of the machine to load themselves as a hypervisor under the original operating system creating huge booting problems.

[C] Kernel level (**** Most Reactive****)

Kernel-level rootkits add additional code and/or replace portions of an operating system, including both the kernel and associated device drivers. Most operating systems support kernel-mode device drivers, that execute with the same privileges as the operating system itself

Kernel rootkits can be especially difficult to detect and remove, because they operate at the same level as the operating system itself, and are thus able to intercept or subvert any operation made by the operating system.

I would personally rate this type as the most reactive one.

[D] Library level

Library rootkits commonly patch, hook, or replace system calls with versions that hide information about the attacker. They can be found, at least theoretically, by examining code Libraries;The DLL's for changes or against the originally distributed library package; this approach may not succeed however if the code is patched in memory only.

[E] Application level

Application level rootkits may replace regular application/programs binaries with Trojan fakes, or they may modify the behavior of existing applications using hooks, patches, injected code, or other means.


3.How to tackle this problems??

[A] RootKit Hunter

Rootkit Hunter is scanning tool to ensure you for about 99.9%* you're clean of nasty tools. This tool scans for rootkits, backdoors and local exploits by running tests like:

- MD5 hash compare
- Look for default files used by rootkits
- Wrong file permissions for binaries
- Look for suspected strings in LKM and KLD modules
- Look for hidden files
- Optional scan within plaintext and binary files

Rootkit Hunter is released as GPL licensed project and free for everyone to use.

I would Rate this RootKit Hunter as 7.5/10


[B] GMER

I would sugguest this following Application for RootKit Problem Solution.




It scans for:

1.hidden processes
2.hidden threads
3.hidden modules
4.hidden services
5.hidden files
6.hidden Alternate Data Streams
7.hidden registry keys
8.drivers hooking SSDT
9.drivers hooking IDT
10.drivers hooking IRP calls
11.inline hooks
12.Unwanted Processess,Modules,Services,Files
13.Registry changes(It has Built in registry Editor)

It's No "PING" Time

Well..if we face any problem in connecting to any computer in a network,first thing we try to do is PING the comouter. Ping is a computer network tool used to test whether a particular host is reachable across an IP network. It is also used to self test the network interface card of the computer, or as a speed test.



It works by sending ICMP “echo request” packets to the target host and listening for ICMP “echo response” replies.

1.What is the problem??

Can you imagine that this same technique can be used by hackers too?? Computer hackers can ping to find the potentially weak victims on the internet.By pinging onto one system,hackers can determine if they have any sort of interest on that.

2.How can You Block this??

so many methods can be followed but i would be posting in here,one of the simplest tool that does "safegurding" job.

If you can configure your computer to block ping response, it should heightens the level of security for your computer.



Plax Network Suite is an easy to use collection of network tools which give you full control over the internet activity of your computer.

Designed for quick access, the Windows Firewall button provides an instant ON/OFF switch for Windows XP Firewall. Designed to integrate with Windows, and be powerful but simple to use, Windows Firewall operates deep under cover, without bothering you at all.



It can help stop viruses and worms reaching your computer, ask for permission to block or unblock certain connection requests from applications and software, and create a security log if required. It's an automatic first line of defense for those who don't have any other software installed.



Note:I wont say it to be the best amongst the antivirus tools,but yeah,as far as the security upfront is concerned,its preety fine with it.For me,Kaspersky is still the best,so far.

ADSL V/s ADSL 2+

Before I comment anything about ADSL 2+,i would like to share some information regarding ADSL.

1.What is ADSL?

Asymmetric Digital Subscriber Line (ADSL) is a form of DSL, a data communications technology that enables faster data transmission over copper telephone lines than a conventional voiceband modem can provide. It does this by utilizing frequencies that are not used by a voice telephone call.ADSL can generally only be distributed over short distances from the central office, typically less than 4 kilometres.

2.Frequency of ADSL:



The public switched telephone network (PSTN) is the network of the world's public circuit-switched telephone networks.

3.ADSl Standards:




4.What is ADSl 2+?

As shown in the standards of ADSl,ADSL 2+ is the new format which is been used,not widely though.

ITU G.992.5 is an ITU (International Telecommunication Union) standard, also referred to as ADSL2+ or ADSL2Plus.
Commercially it is notable for its maximum theoretical download speed of 24 Mbit/s.

ADSL2+ extends the capability of basic ADSL by doubling the number of downstream bits. The data rates can be as high as 24 Mbit/s downstream and 1.4 Mbit/s upstream depending on the distance from the DSLAM to the customer's home.

ADSL2+ is capable of doubling the frequency band of typical ADSL connections from 1.1 MHz to 2.2 MHz. This doubles the downstream data rates of the previous ADSL2 standard of up to 12 Mbit/s, but like the previous standards will degrade from its peak bitrate after a certain distance.

AIRTEL INTRODUCES 16 Mbps BROADBAND..!! Go AirTel

Bharti Airtel has introduced 16 Mbps wireline broadband on DSL in the country.Well it really sounds interesting.Even when i read it,i was stunned..!!

This service, powered by Airtel's Carrier Ethernet Network, will be initially available in the cities of Delhi NCR, Chennai and Bangalore with phased roll-out to additional cities of Hyderabad, Pune, Mumbai and Kolkata.



Note:Picture Shared From :http://www.topnews.in

Airtel's 16 Mbps broadband service can be availed via choosing from the following 2 Tariff Plans -

1. Speed Combo 2999 - receive 16 Mbps broadband speed with monthly data transfer limit of 20 GB along with a fixed line connection at Rs. 2999 per month.

2. Speed Combo 4999 - receive 16 Mbps broadband speed with monthly data transfer limit of 50 GB along with a fixed line connection at Rs. 4999 per month.

I wish I could try it in pune,but due to the fact that i already run youtele Connection for internet,my wish wont come true so soon..!!

actually the main reason to try this out is just to find who is more superior of both..BSNL V/s Air tel@16MBPS

Airtel delivers its broadband service to customers through a fibre backbone of Carrier Ethernet Network with last mile delivery on copper using ADSL2+ technology.

Well..i will add in the details of ADSL 2+ technology tomorrow as i don't wanna mix-in two different posts into same post ;yet the concept being dependent..!!

The Smaller The Better..!!

Nope wonder apple has been growing with enormous features in iPod so much so that nope other company really fetches the market strength growth so consistent.

The world’s smallest music player also happens to be the world’s first talking one. Two things that make the iPod shuffle one amazing device.



Though i don't have an iPod,i still like to read Apple product specifications and also love to visit Apple outlets.

Apple describes this iPod as "The Smallest and the Biggest"..well this too has a meaning

1.Smallest: 45.2 mm (1.8") tall x 7.8 mm (0.3") thin to be exact.

To make this shuffle smaller,Apple has moved the music controls over to ear bud cord rather than on the player.Well,it really suits it,very convenient.

2.Biggest: Upto 1000 Songs Storage capacity.

iPod shuffle has 4GB of storage, you have plenty of room to store hours and hours of music — up to 1,000 songs.* With room for multiple playlists, too


Another features that really is the best is the "Voice Over".Say you’re listening to a song and want to know the title or the artist. With the press of a button, VoiceOver speaks them in English as the music dips down. It even announces the names of your playlists. And when your battery needs charging, VoiceOver tells you

Thinner than Rest..!!

From mega storage to 1 TB HDD and now 3+ KG Weight laptops to worlds thinest laptop;the tech journey has been really awesome in all respects.

Dell unveiled its Adamo laptop , calling it the world's thinnest notebook as it seeks to compete in the high-end ultraportable market defined by Apple Inc's MacBook Air.



The sleek, aluminum-encased notebook is 0.65-inches thick and comes with a 13.4-inch screen and a 128-gigabyte solid-state drive.



Starting at $1,999, the Adamo is positioned as Dell's new high-end brand. Another configuration will sell for $2,699.

How To Keep Software Installers Up To Date..??

With the fast tech changing world,keeping upto date is very important.so i wish to post an important article with regards to the same.

while reading across,i came to know an software called as "Ketarin".here is some of its brief information.

1.What is Ketarin??

Ketarin is a small application which automatically updates setup packages. As opposed to other tools, Ketarin is not meant to keep your system up-to-date, but rather to maintain a compilation of all important setup packages which can then be burned to disc or put on a USB stick.

2.Features of ketarin:

1.Clean and lean user interface
2.Groupable application overview
3.lexible methods to specify save paths
4.Regular expression support
5.Group applications by user defined categories
6.XML based import/export of applications
7.Run custom commands after downloading
8.Online database

3.ScreenShots*