Sysinternals
Sysinternals provides many small windows utilities that are quite useful for low-level windows hacking. Some are free of cost and/or include source code, while others are proprietary. Survey respondents were most enamored with:
- ProcessExplorer for keeping an eye on the files and directories open by any process (like lsof on UNIX).
- PsTools for managing (executing, suspending, killing, detailing) local and remote processes.
- Autoruns for discovering what executables are set to run during system boot up or login.
- RootkitRevealer for detecting registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit.
- TCPView, for viewing TCP and UDP traffic endpoints used by each process (like Netstat on UNIX).
Many of the Sysinternals tools originally came with source code and there were even Linux versions. Microsoft acquired Sysinternals in July 2006, promising that “Customers will be able to continue building on Sysinternals' advanced utilities, technical information and source code”. Less than four months later, Microsoft removed most of that source code. For downloads and more information, visit the Sysinternals homepage.
- Popularity
- #17,
7 - Latest release
- Feb. 4, 2011 (13 years, 9 months ago)
- Links
- Rating
- ★★★★★ (2)
★★★★★100% ★★★★0% ★★★0% ★★0% ★0%
Frequesntly use ProcessExplorer, PsTools & Autoruns. All great tools for stopping malware, etc
Sysinternals tools are great. Sadly rootkitrevealer is now outdated and no longer supported plus it runs only on 32-bit systems.