McAfee will distribute Rootkit Detective 1.0 free of charge via the McAfee Web site. Rootkit Detective has been in beta on the McAfee site for several months and was downloaded more than 100,000 times. The tool promises the ability to detect and remove rootkits, find hidden kernel processes and registry entries, track modifications that indicate rootkit activity and test kernel memory.

According to McAfee, nearly 7,500 new rootkit variants have been detected since the beginning of 2007, double the number of rootkits found in 2006. Rootkit Detective uses a variety of observation tools to detect malware and claims that it has had a 100-percent success rate in detecting rootkits with the approach. McAfee collects the signature information for all discovered rootkits and incorporates that information into its other malware detection and removal products.

According to the McAfee Web site, Rootkit Detective will detect hidden registry objects, processes and files; provide information about all running processes; monitor SSDT and IAT/EAT hooks for suspicious activity; cleans malware by renaming or deleting it; allows the user to terminate suspected processes; report new activity; submit suspect samples; and log its own activities for the user's information.

Rootkit Detective is available for the following OSs:
• Windows XP Home Edition with SP2
• Windows XP Professional Edition with SP2
• Windows 2000 with SP4
• Windows 2000 Server
• Windows 2003 Server SP1