After nearly 7 years in Product Support Services helping our customers on issues ranging from debugging IIS failures, to identifying performance issues to helping customers with security investigations I have taken on a new challenge and accepted a job...

Sysinternals yesterday released a new version of Rootkit revealer after receiving feedback that people using rootkits were starting to add Rootkit Revealer to the 'root process' to continue to avoid detection. The new version uses a randomly named executable...

F-Secure has finally taken the wraps off a new anti-rootkit tool they call Blacklight (I dig the name): http://www.f-secure.com/blacklight/try.shtml It seems to do a file system scan and may employ a similar technique to that of Rootkit Revealer...

So over the last week we've started to get cases where Rootkit Revealer (having been downloaded by the customer) is not detecting any hidden files / folders / registry entries on the customers machine; yet our own rootkit tools we supply with our IR toolkit...