Author Topic: avast! Boot-time scan and Rootkits  (Read 3573 times)

0 Members and 1 Guest are viewing this topic.

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9406
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
avast! Boot-time scan and Rootkits
« on: July 09, 2005, 08:08:41 PM »
I was thinking something...
Rootkits are designed to hide files and functions from OS itself.
So even antivirus cannot detect them.
Now if we perform boot-time scan,all OS elements are gone and rootkits are useless.
So avast! has some advantage over other AVs right? Or am i missing something?
Visit my webpage Angry Sheep Blog

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: avast! Boot-time scan and Rootkits
« Reply #1 on: July 09, 2005, 08:35:19 PM »
That depends on what kind of rootkits are we talking about. Most of them (but not all) are device drivers, and actually load even before the boot time scanner.
If at first you don't succeed, then skydiving's not for you.

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9406
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: avast! Boot-time scan and Rootkits
« Reply #2 on: July 09, 2005, 08:53:45 PM »
I thought you get just basic functionality at boot-time. Looks like it's not that simple...
Visit my webpage Angry Sheep Blog

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: avast! Boot-time scan and Rootkits
« Reply #3 on: July 09, 2005, 08:56:18 PM »
At this stage, the device driver can (but necessarily doesn't have to be) loaded. It's more or less its decision at which stage of the boot process to load...
If at first you don't succeed, then skydiving's not for you.