Worried about Rootkits ? _ So are M$ !!

[basa]

So you're well protected against trojans, malware and virus, well tough !!! even Microsoft are concerned they cannot protect you from the latest threats which are rootkits.

Check out the links in the article to really get you paranoid !!!

[grubbymitts]

Even rootkits can't hide forever. Eventually processes are discovered to locate and remove them.

[Horace]

http://www.sysinternals.com/Utilitie...tRevealer.html

[grubbymitts]

have you ever used that thing? It brings up bazillions of hits and the average user would poop themselves, when really they are nothing to worry about (usually they are old HD lookup table results etc). Even when it does show up what you are looking for it will only show it to you - not remove it, that's always the fun part.

[MattJones2k6]

Just to let anyone who, who didn't know, but you probably did ...

VISTA or BUENA VISTA means Good View.

GCSE Spanish (might be wrong :P)

[Anonymouse]

You need something like F-Secure's Blacklight - that makes it possible to remove them. You mark the files it finds for deletion, and during reboot - before the Windows API kicks in - it adds a .ren extension to them. This has the effect of revealing them to Windows, and after that you can just delete them like any other file.

Part of the reason you might get several hits with RKR is that Windows routinely hides bits of itself from the user; this is a feature (no, not a bug) of the API and, I suppose, is intended to prevent the user accidentally deleting vital parts of Windows...the same patronising logic as that behind the whole file extension hiding thing in Explorer.

If you have a look at Mark Russinovich's blog, you can get the techie details of rootkit identification and removal. Also, have a look for the list of Sony CDs which have theirs on them - that thing, after all, is what started the whole rootkit issue. The various AV/firewall companies are working on the problem, as are Microsoft.

Whether or not they'll solve it is another matter entirely...

Edit: I've just started reading the article; it mentions Spybot...which does NOT find rootkits. At least it didn't find the one I got hit with last year that redirected me to Microsoft.com regardless of what browser I used, disabled McAfee VSO & Firewall, and downgraded IE from IE6 with SP1 to IE5.

[Horace]

Originally Posted by grubbymitts

have you ever used that thing? It brings up bazillions of hits and the average user would poop themselves, when really they are nothing to worry about (usually they are old HD lookup table results etc). Even when it does show up what you are looking for it will only show it to you - not remove it, that's always the fun part.

Yeah that's true. I was just pointing out that there are ways to detect rootkits. Blacklite as mentioned being another app. I just didn't want to post a link to something that could end up with someone removing registry entries or files that were in fact fine.
Also, when using RKR you must not use the PC while scanning since this also causes false positives to be produced. The sysinternals site gives a lot more information on rootkits and how they're detected for anyone really concerned.

[basa]

Originally Posted by Anonymouse

I've just started reading the article; it mentions Spybot...which does NOT find rootkits. At least it didn't find the one I got hit with last year that redirected me to Microsoft.com regardless of what browser I used, disabled McAfee VSO & Firewall, and downgraded IE from IE6 with SP1 to IE5.

Last week I had a clients machine with nearly 200 items of malware (plus a couple of viruses for good measure)

Something on there was disabling her AV (including a second one I installed after uninstalling hers), wouldn't let Spybot or HijackThis even start and blocked all security web sites so I couldn't upgrade def files.

After 3 hours of messing I gave up and reinstalled XP. Fortunately she was excellent at backing up to two HD's. Pity she wasn't as good at careful surfing or running security apps !!