Which application helps security professionals detect and remove rootkits by scanning processes, threads, modules, services, files, disk sectors (MBR), ADSs, registry keys, driver hooking - SSDT, IDT, and IRP calls, and inline hooks?

Which application helps security professionals detect and remove rootkits by scanning processes, threads, modules, services, files, disk sectors (MBR), ADSs, registry keys, driver hooking - SSDT, IDT, and IRP calls, and inline hooks?

• A. Anti-Rootkits
• B. NTFS
• C. GMER
• D. Stream Armor

Answer: (C)

Rootkit detection relies on uncovering hidden artifacts and tampering across multiple layers of the system—from what runs in memory to what resides on disk and how the kernel has been modified. A robust tool for this purpose scans processes, threads, modules, services, and files, and goes deeper to examine disk sectors like the MBR, as well as alternate data streams, registry keys, and driver hooking in places such as the SSDT, IDT, and IRP calls, plus any inline hooking techniques. GMER is designed specifically to perform these comprehensive checks, including detecting hidden items and various hook mechanisms, making it the best fit for identifying and removing rootkits. By contrast, general anti-rootkit tools exist, but the option focusing on a dedicated rootkit detector that scrutinizes those low-level surfaces best matches the described capabilities. NTFS is just a file system, and Stream Armor is not the tool described for this deep rootkit-detection workflow.

Rootkit detection relies on uncovering hidden artifacts and tampering across multiple layers of the system—from what runs in memory to what resides on disk and how the kernel has been modified. A robust tool for this purpose scans processes, threads, modules, services, and files, and goes deeper to examine disk sectors like the MBR, as well as alternate data streams, registry keys, and driver hooking in places such as the SSDT, IDT, and IRP calls, plus any inline hooking techniques. GMER is designed specifically to perform these comprehensive checks, including detecting hidden items and various hook mechanisms, making it the best fit for identifying and removing rootkits. By contrast, general anti-rootkit tools exist, but the option focusing on a dedicated rootkit detector that scrutinizes those low-level surfaces best matches the described capabilities. NTFS is just a file system, and Stream Armor is not the tool described for this deep rootkit-detection workflow.