Kernel Security Therapy Anti-Trolls (KSTAT) is a
very powerful security tool to detect many kinds
of rogue kernel rootkits. It analyzes the kernel
through /dev/kmem and detects modified syscalls as
well as various other problems. This version runs
on 2.4.x only, and can assist in finding and
removing trojan LKMs. It sports network socket
dumps, sys_call fingerprinting, stealth module
scanning, and more. This is not a
'signature-tool'; it requires a bit of expertise
and knowledge of what is going on.
