Rootkits are programs designed to hide malicious activity on a compromised computer by hiding files, processes or registry entries.

learn more… | top users | synonyms

1
vote
1answer
48 views

are there any rootkit/virus/malware/etc.. that a windows 7 factory install could leave behind?

can any sort of malware/ rootkit still be on my computer after a factory install? my dell inspiron running windows 7 had(maybe still does) some sort of malware (a rootkit maybe) at its worst point it ...
0
votes
1answer
81 views

Computer possibly hacked. Now what

I think someone somehow managed to gain remote access to my computer and was able to log into my ebay account and purchase some stuff. I was noticed the suspicious activity, and yanked the power cord, ...
1
vote
0answers
37 views

Prevent www.win32.cn/g9 being run automatically [duplicate]

I have recently bought an a4 tech wireless mouse + keyboard. Everything was working fine, but when i started cmd as admin, i started getting the run command automatically and it executes ...
6
votes
3answers
16k views

Suspicious drivers, is it a rootkit?

The following entries show up in DriverView on my PC: C:\Windows\System32\Drivers\dump_dumpata.sys C:\Windows\System32\Drivers\dump_dumpfve.sys C:\Windows\System32\Drivers\dump_msahci.sys These ...
9
votes
9answers
7k views

UAC being turned off once a day on Windows 7

I have strange problem on my HP laptop. This began to happen recently. Whenever I start my machine, Windows 7 Action Center displays the following warning: You need to restart your computer for ...
59
votes
7answers
20k views

My webcam just came on “out of the blue”

I have a Microsoft LifeCam HD sitting atop my monitor. Today, completely out of the blue, its light came on -- I was simply browsing the web (in Chrome) when it happened. After about 5 minutes the ...
2
votes
1answer
181 views

VirtualBox VM Rootkit Infection

What is the risk of having a host machine infected if a VirtualBox VM running on the host gets infected? Let's assume both run Windows 7.
2
votes
1answer
49 views

Sony CDs and “Rootkit scandal”

I recently bought a secondhand copy of a CD that was part of the Sony "Rootkit Scandal" in 2005. I assume it to be infected until proven otherwise. Am I safe to try to rip this on my PC with modern AV ...
1
vote
1answer
61 views

Can rootkits and malwares affect a live ubuntu usb with no peristence?

Can rootkits and malwares affect a live ubuntu usb with no peristence ? Can any malware possibly persist and affect all the sessions ? Also, can it affect current session if it cannot persist ? I am ...
0
votes
0answers
160 views

Tcpview and netstat are not showing any tcp connections

I know I currently have tcp connections open, but neither tcpview, or netstat can show them. Tcpview show a blank page and netstat returns an empty list. Netstat seems to handle udp connections fine. ...
2
votes
2answers
334 views

Process With No Name: A Possible Linux Rootkit?

Situation When I was looking at gnome-system-monitor one time, I saw a process without a name. Didn't bother me at first. Later, my laptop seemed to be heating up, and would see spikes in CPU ...
1
vote
0answers
97 views

Is this malware?

I have a machine running Linux Mint (qiana). I noticed it was often slow and when I looked at top I found PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND ...
2
votes
4answers
111 views

How does badBIOS jumps airgaps? [closed]

I was reading this article from Ars on badBIOS and came across this line which states the malware, has the ability to use high-frequency transmissions passed between computer speakers and ...
0
votes
1answer
1k views

EFI partition malware?

I have a 2011 Macbook Pro, running 10.8.2 and was worried that the laptop may have been tampered with while left unattended for a few days while abroad in Asia. I have mounted my EFI partition using: ...
1
vote
1answer
2k views

I can't edit /etc/init.d/rc.sysinit as local - vi says it's [readonly]

I have a rootkitted SUSE Linux and I'm trying to fix it. I have root privileges but when I go: cd /etc/init.d vi rc.sysinit vi tells me the file is [readonly]. The owner of the file is root.root ...
0
votes
2answers
268 views

My friend fell for a tech support scam. I formatted her computer. What should I do now?

My friend received a call from a person claiming to be a Microsoft tech support representative. This person claimed her laptop was infected with malware and compromised by hackers. He proceeded to ...
2
votes
5answers
468 views

How to get a free full anti malware coverage on windows? [closed]

There are many specialized anti malware applications, namely: Anti-virus Anti-spyware Anti-malware Anti-rootkit And so on. What combination of free Windows tools would protect me from any sort of ...
6
votes
2answers
656 views

Why is elasticsearch user running SSHD?

My home network is frequently down and I've narrowed down the problem to my ubuntu box. $ ps -ef | grep elastic elastic+ 11183 1 0 8월10 ? 00:07:49 [.ECC6DFE919A382] eugenek+ 14482 14453 0 ...
2
votes
2answers
250 views

Cannot delete folder or files inside

I have a rather strange problem. I have encountered a folder with a file in it, that I can neither see or delete. This is, I believe, a rootkit and I am desperate to get it off my machine. I am logged ...
0
votes
0answers
5k views

What is “.HFS+ Private Directory Data” and why is it SO BIG?

I’m recovering this old disk I accidentally formatted, and stumbled across a hidden and HUGE folder of questionable origin. I can plainly see the folder’s contents thru a data rescue program. By ...
-5
votes
1answer
118 views

What is a rootkit?

I use Avast as my antivirus. Yesterday while using my system, an Avast popup came up saying 'a suspicious rootkit has been found'. Avast suggested to delete it and I did so. Normally when Avast finds ...
12
votes
4answers
2k views

Am I attacked or just stupid?

I run a server using Debian Squeeze with several OpenVZ containers. The containers run mostly Squeeze, some Lenny, and some already updated to Wheezy. The host doesn't do that much beyond iptables and ...
1
vote
3answers
675 views

Is there some file browser that uses low level functions to browse hard disk?

I have Windows 7, NTFS hard disk. I have detected rootkit files but can't delete them through Windows explorer, obviously because they are not visible. Is there some other file browser that is using ...
0
votes
1answer
344 views

OS X Rootkit Hunter 0.2 - Results - Help interpreting

maybe someone can help me makes sense if these scan results are something to be worried about and if so, how to fix them. I seems that I do not have any viruses (check with Sophos AV) or rootkits, but ...
0
votes
0answers
72 views

Rootkit I can not find.

I am running windows 7 ultimate. Chrome Browser. and advance system care. I have run every malware scanner I can find and all the rootkit scanners as well. Nothing seems to be able to find this thing. ...
3
votes
2answers
25k views

what does it mean for MalwareBytes to find malicious registry keys but nothing else?

I have a machine that is obviously infected, and when I ran MalwareBytes it told me that it found some "malicious" registry keys (surprisingly enough these contained file path to currently ...
1
vote
1answer
3k views

How to find out if my MBR is infected?

I imagine that bootkits and other malware can install themselves in the MBR and be invisible to antivirus software running after the MBR was executed. Is there any way to execute an antivirus scan on ...
0
votes
3answers
2k views

“autorun.inf” autogenerated in each drive generates EXE and PIF files in Windows CP [duplicate]

I have Windows XP SP2 installed on my laptop, its been infected by a virus, which creates autorun.inf in each of my drives as read-only, hidden and system file attribute being set, and which generates ...
0
votes
1answer
212 views

Need guidance in understanding rkhunter results

Today, I performed a system wide scan for rootkits using the rkhunter --check command. All results were ok, with the exception of a warning: [10:14:30] Warning: The command '/usr/bin/unhide.rb' has ...
3
votes
2answers
476 views

OS X rootkit/spyware scanners?

For OS X, I have discovered Rootkit Hunter recently and liked the functionality. What other rootkit/spyware scanners for OS X have been developed that are available for use?
2
votes
1answer
1k views

If I connect a USB drive to a PC with a rootkit, will the USB drive be infected as well? [closed]

I'd like to know if I run the risk of infecting a pendrive if I connect it to a PC with a rootkitted hard disk. Let's say I have a PC infected with the TDSS rootkit, and I run tdsskiller from a USB ...
1
vote
2answers
237 views

How do I remove a root kit from Windows XP? [duplicate]

Possible Duplicate: How do I get rid of malicious spyware, malware, viruses or rootkits from my PC? I was looking for root kits following these instructions ...
0
votes
1answer
590 views

Remove or Disable MBR from old C:\ Drive

Using a USB to Sata connection from an old XP box, is it possible to remove/disable the MBR\boot sector on a drive pulled from a Win7 box? C: - I can see the drive and folders and such on my XP box, ...
2
votes
1answer
1k views

My computer gives a known virus warning and reboots

"Windows must now restart because the Plug and Play service terminated unexpectedly." "Windows must now restart becasue the DCOM Server Process launcher service terminated unexpectedly." ...
1
vote
1answer
1k views

No internet connection on laptop

I'm trying to recover from a rootkit infection, where I am unable to connect to the internet. When I try to ping the router this is the output: Pinging 192.168.1.254 with 32 bytes of data: Reply ...
0
votes
1answer
421 views

Unknown undeleteable, unformattable partition

I had two partitions on my hard drive labeled as unknown in gParted that showed up out of nowhere. I use 3 OS's on my computer, Windows which I just recently deleted, Backtrack5, and Ubuntu 12.04 ...
1
vote
0answers
628 views

is it possible to monitor dll injection events on Windows, such as to detect user mode rootkits?

wikipedia article's section on user mode rootkits is not quite clear about the mechanism of injecting code into running processes. Does this take advantage of normal OS functionality and so could be ...
0
votes
2answers
473 views

rogue process consumes too much memory in linux

I was going through the output of top when i saw a process listed as pine -i I don't have pine in my system ! Then i got into proc and did a `ls -l /proc/9827/exe` 9827 is the process id. It ...
2
votes
7answers
5k views

How can I remove Rootkit.TDSS?

Is there a good way to wholly remove Rootkit.TDSS? Malwarebytes and Spyware Doctor both detect it on an old XP machine I have. Malwarebytes says it's removing it, but when I reboot and rescan, it ...
5
votes
8answers
3k views

Which rootkit cleaner do you recommend for Windows XP? [closed]

Answering the question "Task Manager shows 100% CPU utilization, but nothing in process list does.", Paul Woodward stated that his problem with 100% CPU was a rootkit infecting his computer. My ...
1
vote
3answers
2k views

how to stop a driver from running - it self protected and rootkit hidden

I have this serous problem For the first time I can not stop a program from running. Something is on one laptop computer that is run as system legacy driver, and self protected and hidden on ...
3
votes
1answer
141 views

Can signature verification expose a rootkit?

I know that rootkits operate as part of the kernel, driver or service running on the system, injecting themself into DLLs or installing as a legitimate applications. If I were to scan the system with ...
3
votes
4answers
543 views

Measures when routinely checking security on a home Ubuntu server

I use an old Mac mini with latest Ubuntu server to have a "home Gmail": with minimal time spent on configuration I have my webserver with wiki, mail server etc. (and no Google Ads) All ports not used ...
-1
votes
1answer
607 views

Deleting content in swap space and emptying cache using terminal in linux

Wish a script which would delete cache content and remove additional files which have been downloaded via the internet and saved voluntarily by the user and files any thing other than those used by ...
2
votes
3answers
3k views

rootkit: Avast says it deletes it, but it detects it every time I boot up. How do I get rid of this?

After cleaning up the majority of my malware infestation with Process Explorer and Autoruns I am relying on Avast antivirus to clean up the rest. It continues to find a rootkit described as follows: ...
1
vote
2answers
551 views

Examples of usable rootkits

I'm trying to learn more about rootkits and was hoping to take one and let it loose in a virtual environment. Does anyone know of a rootkit currently available that I can safely use to do this, and ...
0
votes
1answer
215 views

Reality of a Windows Vista “recovery disk” virus?

I recently borrowed a disk from a guy I don't really know. It was a Windows Vista install disk (lost my old one, and needed to reformat). The disk was a copy of the original, and I was wondering how ...
4
votes
4answers
916 views

Strange phishing attack?

When I login to wachovia/wells fargo/amazon/paypal , no matter the user/pass that I insert, i get a "we need to verify your information" page where they ask me everything, from the atm pin to my ssn ...
2
votes
1answer
7k views

Windows-7 system files integrity

Is there a tool that will check integrity of system files in Win7 and search for invalid or changed ones. I would like to find which files were changed by rootkit installed on system. It would be nice ...
5
votes
5answers
4k views

BIOS root kit? Or, how do I fresh install a clean BIOS?

So I was installing questionable operating system onto my EEE pc and it required me to downgrade the BIOS which I really am not an expert at. I used a patch and it appeared to work. Now, I'm paranoid ...