Filehippo

Safe shield iconSafe Downloader

The Safe Downloader downloads the app quickly and securely via FileHippo’s high-speed server, so that a trustworthy origin is ensured.
In addition to virus scans, our editors manually check each download for you.

Advantages of the Safe Downloader

  • Malware protection informs you if your download has installed additional unwanted software.
  • Discover additional software: Test new software that are waiting to be discovered in the downloader.
  • With us you have the choice to accept or skip additional software installs.

RootkitRevealer is an advanced rootkit detection utility. It runs on Windows NT 4 and higher and its output lists Registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit.

RootkitRevealer successfully detects many persistent rootkits including AFX, Vanquish and HackerDefender (note: RootkitRevealer is not intended to detect rootkits like Fu that don't attempt to hide their files or registry keys).

Since persistent rootkits work by changing API results so that a system view using APIs differs from the actual view in storage, RootkitRevealer compares the results of a system scan at the highest level with that at the lowest level. The highest level is the Windows API and the lowest level is the raw contents of a file system volume or Registry hive (a hive file is the Registry's on-disk storage format).

Thus, rootkits, whether user mode or kernel mode, that manipulate the Windows API or native API to remove their presence from a directory listing, for example, will be seen by RootkitRevealer as a discrepancy between the information returned by the Windows API and that seen in the raw scan of a FAT or NTFS volume's file system structures.

Enlarged image for RootkitRevealer
RootkitRevealer 0/1

Technical

Title
RootkitRevealer 1.71 for Windows
Requirements
  • Windows XP
  • Windows NT
  • Windows 2000
Language
English
Available languages
English
License
Free
Latest update
Author
Microsoft SysInternals
SHA-1
e32fc009c9c27c4448f0ba020d3a22e8f9e883d1
Filename
RootkitRevealer.zip

Program available in other languages



Changelog

We don’t have any change log information yet for version 1.71 of RootkitRevealer. Sometimes publishers take a little while to make this information available, so please check back in a few days to see if it has been updated.

Can you help?

If you have any changelog info you can share with us, we’d love to hear from you! Head over to our Contact page and let us know.

Explore apps

Related software