I try to retrieve information about machine, all running processes, threads, loaded drivers and dlls with full path from dump.
is it possible to find (reveal) hidden processes and injected threads (by rootkits or malware) which was hidden from explorer and AV?
I have small collection of old rootkits, some of them dont have own process - how it is possible to find symptoms of infection, like hooks and injected threads/code?
Currently I am using these commands and extensions to get information:
!process 0 0 , !process 0 7 or !sprocess -4 7
lm kv
!dml_proc
vertarget
!cpuid and !cpuinfo
!lmi
!handle (how to get list of all open files? like handle.exe -a do?)
can somebody suggest other ways to complete this task?
thanks
pav