Looking for Rootkit Removal

Im looking for a good free rootkit removal/scanner for Vista x64 systems. I appear to have a clean system, but I figured Id try one last thing before finally switching to Windows 7.

 

64 bit or 32 bit?
If 32, this site has listings for Vista compatible anti rootkit scanners.


http://www.antirootkit.com/blog/category/rootkit-scanners/

 

I said in the original post. x64

 

Pardon me.

Have a look at Sophos Anti Rootkit..

http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

 

Thats funny I just downloaded it.

 

I "assume" that any of the Antivirus Rescue CD's would be considered to be both 32 bit and 64 bit since they do the scan when Windows is not operating. AVIRA states that scans with their Rescue CD will allow the rootkits to be visible since Windows is not operating at the time.

http://www.free-av.com/en/products/12/avira_antivir_rescue_system.html

AVIRA Rescue CD Tutorial:

http://forum.avira.com/wbb/index.php?page=Thread&threadID=82163

Some other AV Rescue CD’s:
F-Secure
Kaspersky
BitDefender
DrWeb

 

Sophos Anti Rootkit revealed 6 things. None of which it recommends to remove.

2 are for SecuRom data
1 is for a Driver for sptd.sys
1 is for Crucials RAM scanner
2 are for Registry keys in HKEY USERS shell extensions

The registry keys look funny. They read:

\HKEY_USERS\S-1-5-21-3187278895-1530033346-4051415200-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{74933AAB-A691-C0EF-9432-6A439562A9FB}\haifbocjkipfcaio

\HKEY_USERS\S-1-5-21-3187278895-1530033346-4051415200-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{74933AAB-A691-C0EF-9432-6A439562A9FB}\iagfhfkgpjfnoedbfn

 

Hi,

aaaa... There are currently NO rootkits for the 64bit environment ...

sptd.sys - is from Daemon Tools.

Try ESET SysInspector (link dans my Signature), also Advanced Windows Service Manager from securityxploded: http://securityxploded.com/winservicemanager.php

These two works in Windows 64bits.

P.

 

ye those registry look somewhat "strange" to say the least...

 

There werent any in 06-07, but its been 2 years. There has to be atleast one by now.

 

\HKEY_USERS\S-1-5-21-3187278895-1530033346-4051415200-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{74933AAB-A691-C0EF-9432-6A439562A9FB}\haifbocjkipfcaio

\HKEY_USERS\S-1-5-21-3187278895-1530033346-4051415200-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{74933AAB-A691-C0EF-9432-6A439562A9FB}\iagfhfkgpjfnoedbfn

They look strange, the last jumbled stuff anyway. But that may be the very nature of the security account assigning jumbled up numbers letters (encryption).

 

BartPE CD/DVD
Linux LiveCD
Slave the hard drive