SysInternals Suite

[usasma]

Viewing Debug info without having to install WinDbg.
More info here: http://technet.microsoft.com/en-us/sysinternals/bb896647

 

[Wrench97]

Interesting tool, time to go play with it now

 

[Corrine]

Updates: Autoruns v 11.3, LiveKd v 5.2, Strings v 2.5 and Trojan Horse, Mark's sequel to Zero Day, available for pre-order

Autoruns v11.3: This update to Autoruns, a utility that shows the executables, drivers, and DLLs configured to autostart, adds several new autostart locations, sets a file association for its log file extension, reports the target of Rundll32 and other host executables, and fixes several bugs.

LiveKd v5.2: LiveKd, a command-line utility for performing live read-only debugging of the local system and virtual machines, now includes an option that has it generate a fully-consistent kernel dump file of a running system.

Strings v2.5: Strings, a command-line utility that dumps a file’s printable UNICODE and ASCII strings, adds an option to specify the starting offset in the file from where it will scan for strings.

 

[jcgriff2]

I like the new highlighting of "file not found" entries.

​

AutoRuns EXE direct download - http://live.sysinternals.com

 

[satrow]

I like the new highlighting of "file not found" entries.

They can be part of an active rootkit or 'super-hidden' anti-cheat drivers like GameGuard, etc. so making them stand out is very useful!

 

[jcgriff2]

Agree.

Nothing quite that spectacular in my AutoRuns, though... just a few lingering, benign items!!!