Free Republic
Browse · Search
General/Chat
Topics · Post Article

To: jdm
There is a tool I have used called Rootkit Revealer (download and description at link - it's on Microsoft.com but the author is a long-time Windows engineer/tinkerer and wrote the program before he was hired into Microsoft) that can find rootkits. It compares files and processes viewed from the API level with raw file data; if there are discrepancies, it's possible that a malicious process (i.e. a rootkit) is keeping the raw data from being seen by the API.

It will show you whatever might be running, but doesn't have removal capabilities. Your best bet would probably be to Google whatever it finds to see if you can find manual removal instructions. Be warned that rootkits can be very, very difficult to remove from within the runtime environment; if you have one, you may need to boot from a different kernel (such as a Linux or WinPE LiveCD) to remove it. Many people advise that the only sure cure is to fdisk/format and reinstall everything from scratch.

27 posted on 10/23/2007 3:49:01 PM PDT by Turbopilot (iumop ap!sdn w,I 'aw dlaH)
[ Post Reply | Private Reply | To 26 | View Replies ]


To: Turbopilot

Ug, doesn’t sound like much fun! Thanks for your reply. I actually am burning Rootkit Revealer to a CD to use later. Hopefully AVG Anti-Rootkit can fix the problem without me having to reformat and start from scratch. I’m not even sure it’s a rootkit, just speculating based on the fact that it’s pretty much invisible to every anti-virus/spyware software out there.


28 posted on 10/23/2007 4:05:54 PM PDT by jdm
[ Post Reply | Private Reply | To 27 | View Replies ]

Free Republic
Browse · Search
General/Chat
Topics · Post Article


FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson