Which tool is described as scanning for rootkits by examining processes, threads, modules, services, files, MBR, ADSs, registry keys, and inline hooking?

Which tool is described as scanning for rootkits by examining processes, threads, modules, services, files, MBR, ADSs, registry keys, and inline hooking?

• A. GMER
• B. Anti-Rootkits
• C. Stream Armor
• D. NTFS

Answer: (A)

Rootkit detection hinges on exposing components that can be hidden from normal system views. A scanner that looks across processes, threads, modules, services, files, MBR, ADSs, registry keys, and inline hooking is designed to uncover concealment at memory, storage, and boot levels. GMER is built to do exactly that. It specifically targets rootkit hiding techniques by detecting hidden processes and threads, hidden drivers/modules, suspicious services, concealed files and ADSs, bootkit activity in the Master Boot Record, unusual registry entries, and signs of inline hooking in system call or interrupt handling. This broad, multi-layer approach is what makes GMER the appropriate choice for identifying rootkits described by those artifacts. The other options are either generic terms or tools not focused on this comprehensive rootkit-scanning capability, or they refer to a filesystem rather than a rootkit detector.

Rootkit detection hinges on exposing components that can be hidden from normal system views. A scanner that looks across processes, threads, modules, services, files, MBR, ADSs, registry keys, and inline hooking is designed to uncover concealment at memory, storage, and boot levels. GMER is built to do exactly that. It specifically targets rootkit hiding techniques by detecting hidden processes and threads, hidden drivers/modules, suspicious services, concealed files and ADSs, bootkit activity in the Master Boot Record, unusual registry entries, and signs of inline hooking in system call or interrupt handling. This broad, multi-layer approach is what makes GMER the appropriate choice for identifying rootkits described by those artifacts. The other options are either generic terms or tools not focused on this comprehensive rootkit-scanning capability, or they refer to a filesystem rather than a rootkit detector.