Bobkberg |
I’d add two more things in addition to KevinBeaver’s suggestion.
1) Check out the (former) SysInternals RootKitRevealer (http://technet.microsoft.com/en-us/sysinternals/default.aspx). This will go through the system and compare the files that the Windows API presents as visible vs. what can be found in the file system itself.
2) Open a command prompt, navigate to the same directory and see what a DIR command produces. In at least the case of the “Downloaded Program Files” and “Downloaded Installations” I’ve found significant differences, especially when looking for malware.
As with many other practitioners, I do most malware cleanup with the hard disk under test being physically mounted on a “cleanup” system so that any malware - especially the more sophisticated ones - does not get a chance to be loaded with the O/S.
Bob
Microsoft Windows, Servers, Networking, Security, Network management, Windows 2000 Server, Viruses, Spyware, Windows Security, Application security
Hello, I have a Win 2000 Server in a small workgroup. I can't can't see and open hidden files. I tried changing everything in Folder options and editing Hidden and SuperHidden attributes in registry but no luck. After changing the Registry, when I try to view hidden files, registry changes back to its old attributes. It seems some program is running which is creating all the problems. Any help on this would be highly appreciated. Thanks in advance. 
0
