Hidden DLLs

[SysAdMini]

Locating Hidden Clampi DLLs (VAD-style)
http://mnin.blogspot.com/2008/11/locating-hidden-clampi-dlls-vad-style.html

[pnuemo]

that's a good read.  thanks for sharing.

[SysAdMini]

Recovering CoreFlood Binaries with Volatility
http://mnin.blogspot.com/2008/11/recovering-coreflood-binaries-with.html

[SysAdMini]

Malfind Volatility Plug-In
http://mnin.blogspot.com/2009/01/malfind-volatility-plug-in.html

Malfind.py is a Volatility plug-in to find and extract hidden and/or injected code from physical memory dumps. It basically streamlines the multiple steps described in the two previous posts (Recovering CoreFlood Binaries with Volatility and Locating Hidden Clampi DLLs VAD-Style).