I MIGHT have a rootkit. Now what ?

Hi,

I installed the free Macafee and the free AVG rootkit finders and they found different things. Frankly I am not too sure what to do with the output either.

What programs should I run to make sure / see if I have a rootkit ? If I do think I have one, what is the best way to get rid of it? Would an online scan by BitDefender or Kaspersky find it ?

Thanks,

B

 

Can you make a note of what they are detecting and post it in your next reply.

 

Here is what the rootkitdetective report;

"
McAfee(R) Rootkit Detective 1.1 scan report
On 12-02-2008 at 11:15:16
OS-Version 5.1.2600
Service Pack 2.0
====================================

~copied and removed whole report\uploaded locally....Bubba~
View attachment rootkitdetective.txt

 

There are several antirootkit applications. I haven't come across a rootkit so can't say which ones are effective.

http://www.emsisoft.com/en/software/free/


http://www.grisoft.com/doc/download-free-anti-rootkit/us/crp/0

http://www.gmer.net/index.php

http://www.antirootkit.com/software/IceSword.htm

http://www.microsoft.com/technet/sysinternals/Security/RootkitRevealer.mspx

http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

http://www.antirootkit.com/software/SysProt-AntiRootkit.htm

http://www.trendmicro.com/download/rbuster.asp

 

I've had used rootkit unhooker, with good results. You must be careful, though, since I've heard you can do more damage than good if you don't know what your doing.

Dr.Web cureIt claims it can deal with rootkits, but I've never tested it against one.

 

sp_rsdrv2.sys is part of Spyware Terminator, and is legit.

 

Hello brjoon1021,

Since Wilders no longer offers one on one cleaning services, I'm afraid we're going to have to refer you to one of the security forums that has active Spyware Cleaning services available.

Read the following thread and choose one of the forums listed in it, join there and they should be able to assist you:

https://www.wilderssecurity.com/showthread.php?t=42148
----------------------------

As noted in our long standing Announcement concerning HJT and\or similar logs....

Regards,
Bubba