5

Answering the question "Task Manager shows 100% CPU utilization, but nothing in process list does.", Paul Woodward stated that his problem with 100% CPU was a rootkit infecting his computer. My computer seems to suffer from the same problem.

Which software for Windows XP do you recommend for detecting and removing a rootkit?

8 Answers 8

6

I don't think you can actually use it to 'clean' a rootkit, but a very good 'detector' is RootkitRevealer from Sysinternals.

6
  • Yeah, i feel that there is no easy solution. RootkitRevealer looks like a good scanner. I´m trying it right now. Jul 29, 2009 at 0:05
  • 1
    +1 for anything from SysInternals. Bonus because you don't have to install anything. You can run it directly from the site download link. Jul 29, 2009 at 0:24
  • I accepted your question because, like @Robert said, its from SysIternals and it runs directly from the download (no need to install). Aug 4, 2009 at 1:00
  • I like SysInternals alot, but in this case, the real problem was what the hell to do with the info what I got back
    – D'Arvit
    Jun 9, 2010 at 14:03
  • 2
    FORMAT your hard disk. Best rootkit cleaner there is.
    – Warren P
    Jul 30, 2010 at 18:36
5

I wouldn't trust any of them. Once you've been "pwned", the best thing to do is start with a fresh system install.

Soon not even that will be enough. I've heard of malware that will find an EEPROM chip on your motherboard and over-write it with it's own firmware. The new firmware will duplicate the functionality of the previous firmware, but also have a copy of the virus waiting to install when that code is invoked. So you could completely reformat your hard drive and still be infected.

5
  • 1
    Indeed,, reinstalling looks like the best way. Maybe, the conclusion from this thread is if you find a rootkit in you computer, do a fresh install. But, how can i reliably find my machine have been "pwned"? Jul 29, 2009 at 1:30
  • 1
    Ironically enough, the best protection against EEPROM rootkits is old-school jumpers -- set it read-only with a jumper and that infection just isn't going to happen. Not sure if board manufacturers will be bringing them back anytime soon though -- they're probably hanging out with Betamax tapes at this point.
    – romandas
    Jul 29, 2009 at 3:23
  • 1
    Oh, and +1 -- have rootkit == nuke and pave from safe media. You just can't know if it's all gone anymore. A/V is a crutch.
    – romandas
    Jul 29, 2009 at 3:24
  • Ultimately where we're going is subsidized netbooks with all your data kept online. You get cell phone data plan + insurance, and it includes the netbook. You get a virus, you just swap it for a new one from your carrier. Jul 29, 2009 at 13:21
  • Um. How about using Linux or Mac and VMWare, and bye-bye to Windows, which is, IMHO, the original Rootkit.
    – Warren P
    Jul 30, 2010 at 18:42
4

I think the pro version of AVG has root-kit protection and removal.

Personaly, if i found my windows box infected with a rootkit, I would just reformat and reinstall the OS. Even if there was a good tool out there that says it removed everything, I just would have a better peace of mind just reinstalling it all.

http://www.avg.com/

2
  • Maybe you´re right. Probably, i´ll walk this path... If i find that rootkit infected my machine, i´ll reinstall from scratch. And, perhaps, its a resason to move to Windows 7. ;-) Jul 29, 2009 at 0:08
  • Yep, reinstall all the way. A rootkit problem, to me, means that you can no longer trust the most fundamental part of your system: the OS.
    – moobaa
    Jul 29, 2009 at 4:19
2

I use a program called "Malware Bytes" It is free and it works great. It kills nasty malware and rootkits.

link text

2
  • Thanx, i´ll look it. And post my thoughts later. Jul 29, 2009 at 1:27
  • i ran it and it seems a good piece of software. But nothing apeared. I think is a hardware problem because now my computer totally freezes. And I have to power-off and power-on to get it working again. Jul 31, 2009 at 23:35
0

There is also sophos anti-rootkit which they claim can remove rootkits. It's a free download but you have to set up an account with them first. I've not had a chance to test the veracity of their claims myself (thankfully).

1
  • Thanx, i´ll look it. And post my thoughts later. But it seems a hardware problem because i ran the others sugentions and nothing apeared. And now my computer totally freezes. I have to power-off and power-on to get it working again. Jul 31, 2009 at 23:33
0

currently trying in vain to remove a rootkit problem on my pc, not having any luck.

have tried avg (my current main antivirus) which doesnt find anything have tried the microsoft online live scanne which didnt find anything have tried prevx which misidentified Tor as malware malwarebytes never finds anything either superantispyware found a rootkit and removed it, but didnt completely fix the problem

have tried thestubware which was recommended to me on here, and it finds the rootkit, but each time it removes it, when i reboot it comes back again with a different file name.

am going to try sophos rootkit revealer now.

0

You might have a rootkit on the computer, in which case you should run HitManPro 3.5, which will detect the TDL3/TDSS/Alueron rootkit.

If you are absolutely sure you have a rootkit, run one of the following (in order of importance)

  • TDSSKiller
  • RootkitRevealer
  • RootRepeal
0

For the record, I've got to suggest PrevX.

When I had malware problems a while ago (initially noticed by some vague McAfee access-protection violation) I was scanning and submitting suspect files all over the shop. [I seem to recall about 25% of the online scanners recognised anything wrong with the files at all - but wouldn't agree on what the problem was.] I went through all the removers and/or manual steps I could find, but those bad files just kept coming back.

PrevX (which was free to download and scan - you had to pay for removal) only gave some kind of generic name for the infection but I decided to throw my £20 quid at them as a last resort because:

a) I was getting desperate: I was about to have to do a reinstall just as a work deadline was resuming;

b) Some prevx fellas were providing some extremely active and knowledgeable support on a forum somewhere and I think that was the only relevant mention of the combination of bad files I was finding on my machine.

c) IIRC, they had some deal where if PrevX didn't remove the infection they promised to personally investigate (like remoting onto your machine or something) - and was it a refund too?

(I'm definitely not affiliated or anything. Was just entirely satisfied by a product that did what I needed it to do at the right time. And, um, I'll renew my lapsed subscription next time I find a problem!)

Not the answer you're looking for? Browse other questions tagged .