RD-CD: An Open Source Rootkit Detection CD

Deborah Kimnach

Tuesday June 27th 2006 at 7:00pm
Wheaton, Illinois Institute of Technology - Rice Campus, Room 103


Rootkits are no longer isolated to the Unix/Linux system, they have been found on most if not all operating systems, including Mac OS and Windows. They and are also becoming harder to detect. Because rootkits modify reporting of space usage and running processes, the running operating system can no longer be trusted if a rootkit is installed. Rootkits are themselves a running process and must survive multiple reboots to re-infect with each startup. To do this, the hacker must store the rootkit in an executable file somewhere on the system (most often on the hard drive) and have it start when the system does. This is where RD-CD comes in.

Using a customized Slax Linux Live CD, RD-CD creates an environment independent of the installed operating system in which to scan for rootkits. The fully customizable framework of Slax allows complete compatibility with reading and writing to most file systems including Microsoft~Rs Windows and Apple~Rs MacOSX file systems. RD-CD takes advantage of this framework and to add a variety of rootkit and malware scanning tools. All of which are either freeware or open source.

To tie these scanning tools together and to make scanning for rootkits easier for the novice as well as the reasonable informed user, RD-CD sports a homegrown Java GUI and custom scripts to perform the scans for you. No need to remember command-line options or syntax; a few clicks and the user can sit back and relax while the scan runs. But if the user actually prefers the command-line, or the system hardware is older and/or is not supported by our GUI, RD-CD has provided support for the user to run our scripts manually or in an automated fashion. No command-line experience is necessary!

Perhaps the best feature of RD-CD is that it is free and open source, giving others the chance to learn and develop from RD-CD's example.


Deborah Kimnach is a fourth year undergraduate student attending Illinois Institute of Technology. She graduated with Associates Degree as a Microcomputer Specialist in December of 2004 and has several years experience in technical support. While at IIT, she has been working on her Bachelors of Information Technology and Management with a specialization in Networking and Communications, Systems Administration, and Systems Security. After graduating this December, she plans to continue at IIT and complete her Masters of Information Technology and Management, specializing in Web Development & E-Commerce, Software Development, and Systems Administration.

She worked as the Team Lead, Layout & Graphics Designer, and Webmaster while on the RD-CD team.

Getting to the meeting

The next General meeting of UniForum Chicago will be:

        IIT Rice Campus
        Room 103
        201 East Loop Road
        Wheaton, IL 60187-8489
Directions to IIT - Rice Campus in Wheaton
The 19-acre campus is located just northeast of the intersection of Naperville and Butterfield roads in sou th Wheaton's Danada development. The campus is three miles west of the Butterfield Road interchange of the N orth-South Tollway (I-355) and two miles north of the Naperville Road interchange of the East-West Tollway ( I-88).

From the North or South: From I-355 (North-South Tollway), exit westbound at Rt.56/Butterfield Road and proceed west 3 1/2 miles on B utterfield Road to East Loop Road. Turn right onto East Loop Road (Phillip's 66 Gas Station on the corner); the campus will be on your right about a block north of Butterfield Road, behind Cozymel's. Park in the Student parking lot behind the building. Room 103 is the first room inside the north enterance.

From the I-294 (Tri-State Tollway), take the I-88 (East-West Tollway) westbound and follow directions "From the East or West" below.

From the East or West: From I-88 (East-West Tollway), take the Naperville Road exit. At the traffic light, turn left onto Naperville Road and continue north for 1\275 miles to Rt. 56/Butterfield Road. Turn right onto Rt. 56/Butterfield Road and proceed 1/4 mile to the first traffic light (East Loop Road). Turn left on to East Loop Road, ( Phillip's 66 Gas station on the corner); the campus will be on your right about a block north of Butterfield Road, behind Cozymel's. Park in the Student parking lot behind the building.

Room 103 is the first room inside the north enterance.

For more information about UniForum Chicago contact

UniForum is a registered trademark of UniForum Association