[Anonymouse]

You need something like F-Secure's Blacklight - that makes it possible to remove them. You mark the files it finds for deletion, and during reboot - before the Windows API kicks in - it adds a .ren extension to them. This has the effect of revealing them to Windows, and after that you can just delete them like any other file.

Part of the reason you might get several hits with RKR is that Windows routinely hides bits of itself from the user; this is a feature (no, not a bug) of the API and, I suppose, is intended to prevent the user accidentally deleting vital parts of Windows...the same patronising logic as that behind the whole file extension hiding thing in Explorer.

If you have a look at Mark Russinovich's blog, you can get the techie details of rootkit identification and removal. Also, have a look for the list of Sony CDs which have theirs on them - that thing, after all, is what started the whole rootkit issue. The various AV/firewall companies are working on the problem, as are Microsoft.

Whether or not they'll solve it is another matter entirely...

Edit: I've just started reading the article; it mentions Spybot...which does NOT find rootkits. At least it didn't find the one I got hit with last year that redirected me to Microsoft.com regardless of what browser I used, disabled McAfee VSO & Firewall, and downgraded IE from IE6 with SP1 to IE5.