View Full Version : Rootkit Plugins
Anthony A
2008-03-21, 17:22
I updated Spybot with new rootkit plugins. I don't see anything different. Is there supposed to be a new feature in Spybot or something in the settings about the new plugins?
I am also confused by this. Typically, a "plug-in" would be visible on the interface, somewhere.
I have seen the response to this question elsewhere: "Please have a look at the news section on our homepage..."
That really doesn't answer our question.
Do we need to configure the plugins? Can we scan for rootkits, or is that just part of a normal scan? How do we see if the plugins are properly installed, activated and configured?
Right now, it seems as if the "plugins" are really just additions to the program's detection abilities during a normal scan. If so, that's terrific. Bravo! Just let us know, please, it that's what it is, or if there are other ways to use these plugins.
Thank you.
MadelineC
2008-03-22, 07:45
I'm curious about this too. I've had a good look round Spybot, but I couldn't find anything about the anti-rootkit plugins. I just assumed that there were some changes made to the scan engine that weren't visible. I haven't found that scans take longer than usual.
MadelineC
2008-03-22, 08:18
I've found out a bit more, although it doesn't really answer the original question. If you go to C:\Program Files, open the Spybot - Search and Destroy folder, then the Plugins folder, there are 3 things there which I think relate to the anti-rootkit plugins, as they're dated 20/03/2008 which was when I got the most recent updates. These plugins are called Chai.dll, Fennel.dll and Mate.dll. They also appear in the Updates folder as zip files called plugchai, plugfennel and plugmate dated 5th March which is presumably when they were created. I seem to remember that this was the date shown on the updater for these 3 plugins.
"Plugins" are not necessarily visible; actually plugins are just files that are able to extend an application without the need to replace it. A place for future extension.
People might know plugins from for example Miranda IM or Pidgin, two popular instant messaging clients. There, plugins would add additional user interface features (visible), or support for other chat networks (not really visible except for a new icon maybe).
While the Spybot-S&D plugin system in theory would allow visual plugins, we never used that before. Where we use plugins is for extension of the scan engine. You do not need to use these plugins yourself in any way; the detection database is the one defining where it'll be used (and a few detections were already included with the beta release and now with the public detection databases, so the plugins are already in use).
Thanks for the clarification, Pepi.
MadelineC
2008-03-23, 07:36
Thanks from me too PepiMK. Your post makes everything clear.
I have one more question: Can i remove my antirootkit software because Spybot will get the rootkits? :cowboy:
I have one more question: Can i remove my antirootkit software because Spybot will get the rootkits? :cowboy:
What software are you currently on?
I think it's not bad keeping any software which is not real-time.
Trend Micro - Rootkit Buster
If you're happy with it, keep it!
Think of SpyBot S&D as a supplement :)