Questions tagged [rootkit]

Rootkits are programs designed to hide malicious activity on a compromised computer by hiding files, processes or registry entries.

Filter by
Sorted by
Tagged with
2 votes
3 answers
4k views

rootkit: Avast says it deletes it, but it detects it every time I boot up. How do I get rid of this?

After cleaning up the majority of my malware infestation with Process Explorer and Autoruns I am relying on Avast antivirus to clean up the rest. It continues to find a rootkit described as follows: ...
jlnorsworthy's user avatar
1 vote
2 answers
618 views

Examples of usable rootkits

I'm trying to learn more about rootkits and was hoping to take one and let it loose in a virtual environment. Does anyone know of a rootkit currently available that I can safely use to do this, and ...
James213's user avatar
  • 111
0 votes
1 answer
230 views

Reality of a Windows Vista "recovery disk" virus?

I recently borrowed a disk from a guy I don't really know. It was a Windows Vista install disk (lost my old one, and needed to reformat). The disk was a copy of the original, and I was wondering how ...
Jess's user avatar
  • 469
4 votes
4 answers
952 views

Strange phishing attack?

When I login to wachovia/wells fargo/amazon/paypal , no matter the user/pass that I insert, i get a "we need to verify your information" page where they ask me everything, from the atm pin to my ssn ...
Magnetic_dud's user avatar
  • 3,614
2 votes
1 answer
8k views

Windows-7 system files integrity

Is there a tool that will check integrity of system files in Win7 and search for invalid or changed ones. I would like to find which files were changed by rootkit installed on system. It would be nice ...
watbywbarif's user avatar
1 vote
3 answers
1k views

Is there some file browser that uses low level functions to browse hard disk?

I have Windows 7, NTFS hard disk. I have detected rootkit files but can't delete them through Windows explorer, obviously because they are not visible. Is there some other file browser that is using ...
watbywbarif's user avatar
1 vote
1 answer
414 views

What is 1UnHooker.sys?

I'm still searching for a solution to my problem as I stated in my previous question (UAC being turned off every time Windows 7 starts (once a day)). Today, a program called SpyHunter found an unknown ...
Mehper C. Palavuzlar's user avatar
10 votes
9 answers
10k views

UAC being turned off once a day on Windows 7

I have strange problem on my HP laptop. This began to happen recently. Whenever I start my machine, Windows 7 Action Center displays the following warning: You need to restart your computer for ...
7 votes
3 answers
26k views

Suspicious drivers, is it a rootkit?

The following entries show up in DriverView on my PC: C:\Windows\System32\Drivers\dump_dumpata.sys C:\Windows\System32\Drivers\dump_dumpfve.sys C:\Windows\System32\Drivers\dump_msahci.sys These ...
user56312's user avatar
  • 183
2 votes
2 answers
5k views

Removing a rootkit from the MBR.. without formatting?

I have run hitman pro and found 'traces of the TDL3 Alureon' rootkit on the computer. However, running TDSSKiller would of solved this issue - but - apparently the symptoms keep coming back so I ...
Jean-François Beaulieu's user avatar
0 votes
1 answer
1k views

Correcting hijacked search in Chrome from "resultdns.com"?

Potentially unnecessary background: I was a Sloppy Internet User today and downloaded an unsafe file without realizing my virus-protection software was offline. I noticed suspicious behavior from my ...
jsnlxndrlv's user avatar
3 votes
1 answer
2k views

Linux workstation: how to know if it has been rooted?

I was working on my Linux "workstation" (it has no sound and I don't play on it nor watch any movie: it's purely a work-machine, hence I call it my "workstation") and suddenly something very weird ...
Weezy's user avatar
  • 535
1 vote
3 answers
2k views

Problem tracking down virus - services.exe port 443 and svchost.exe ports 25 + 80

Hey, I'm running an XP SP3 system with all the latest updates. It seems I have a virus and I'm having a hard time tracking it down. I have some outbound connections; services.exe connects to some ...
aib's user avatar
  • 615
1 vote
1 answer
3k views

I can't edit /etc/init.d/rc.sysinit as local - vi says it's [readonly]

I have a rootkitted SUSE Linux and I'm trying to fix it. I have root privileges but when I go: cd /etc/init.d vi rc.sysinit vi tells me the file is [readonly]. The owner of the file is root.root and ...
Lupi's user avatar
  • 41
0 votes
1 answer
243 views

System restarting after pressing scan on rootkit revealer

My pc is affected with sality virus and after lot of investigation i could get to permanently enable regedit and taskmanager and clean infected files. But i wanted to remove it from the core so i used ...
Anirudh Goel's user avatar
  • 2,971
1 vote
4 answers
1k views

Kernel Mode Rootkit

On the other 3 computers in my family, I believe that we have a kernel-mode rootkit for windows. It appears that the same rootkit is on all of them. We think. We changed all the important passwords ...
D'Arvit's user avatar
  • 737
1 vote
3 answers
3k views

how to stop a driver from running - it self protected and rootkit hidden

I have this serous problem For the first time I can not stop a program from running. Something is on one laptop computer that is run as system legacy driver, and self protected and hidden on ...
Aristos's user avatar
  • 552
1 vote
2 answers
982 views

Computer is broadcasting on port 139 at startup - Virus?

Maybe this isn't the right forum to ask this question, but here it goes. Whenever I boot my vista machine, right after login there has been an extended delay until the actual desktop appears. I also ...
Brett's user avatar
  • 906
3 votes
4 answers
551 views

Measures when routinely checking security on a home Ubuntu server

I use an old Mac mini with latest Ubuntu server to have a "home Gmail": with minimal time spent on configuration I have my webserver with wiki, mail server etc. (and no Google Ads) All ports not used ...
meduz's user avatar
  • 357
2 votes
5 answers
614 views

How to get a free full anti malware coverage on windows? [closed]

There are many specialized anti malware applications, namely: Anti-virus Anti-spyware Anti-malware Anti-rootkit And so on. What combination of free Windows tools would protect me from any sort of ...
Jader Dias's user avatar
2 votes
2 answers
376 views

External rootkit detection software?

The trouble with any rootkit detection software is that if the rootkit is really good, it will work to hide traces of itself from the detecting software as well. I imagine that rootkits could be ...
Doug Harris's user avatar
  • 27.8k
3 votes
3 answers
21k views

Is there a way to find rootkits on 64-bit Windows 7

I was at work and got a help desk call about a rather severe malware infection and it got me thinking about my own computer. I am running Windows 7 64-bit RC1 on my everyday laptop. I run ESET ...
Seth Spearman's user avatar
6 votes
5 answers
6k views

BIOS root kit? Or, how do I fresh install a clean BIOS?

So I was installing questionable operating system onto my EEE pc and it required me to downgrade the BIOS which I really am not an expert at. I used a patch and it appeared to work. Now, I'm paranoid ...
user avatar
2 votes
7 answers
6k views

How can I remove Rootkit.TDSS?

Is there a good way to wholly remove Rootkit.TDSS? Malwarebytes and Spyware Doctor both detect it on an old XP machine I have. Malwarebytes says it's removing it, but when I reboot and rescan, it ...
Chris Farmer's user avatar
5 votes
8 answers
3k views

Which rootkit cleaner do you recommend for Windows XP? [closed]

Answering the question "Task Manager shows 100% CPU utilization, but nothing in process list does.", Paul Woodward stated that his problem with 100% CPU was a rootkit infecting his computer. My ...
Leonel Martins's user avatar
1 vote
2 answers
4k views

What else besides a virus would keep turning on "Show Hidden Files" in WinXP

I've got a couple of machines that definitely recently had viruses and very likely still do. I've run Norton AV, Radix RootKit remover, Sophos Rootkit remover, Spybot, Ad-Aware, CA Antivirus Plus, ...
LachlanG's user avatar
  • 685
3 votes
2 answers
555 views

OS X rootkit/spyware scanners?

For OS X, I have discovered Rootkit Hunter recently and liked the functionality. What other rootkit/spyware scanners for OS X have been developed that are available for use?
Troggy's user avatar
  • 10.2k
1 vote
2 answers
3k views

RootKit Hunter Warnings on Mac OS X

Just executed rkhunter on my new MBP which runs a freshly installed Mac OS X and I get the following warnings: Checking for passwd file changes [ Warning ] Checking for group ...
user avatar

1
2