Rootkits and XP - is the war lost?

chunter

After battling for 2 days to shift one, I eventually did a clean install.

Windows 7 and Vista seem to be lots better at handling/stopping them.

XP seems to be a big wide open door that just lets them tear away.

Combofix and Sophos' Anti-Rootkit can usually find them and delete them. But not always.

The killer is that only the likes of the two above have a proper go at finding them. Your McAfees and Nortons and your free antivirus don't have a clue.

John_Gray

Is the war lost on rootkits? Probably 95% of XP users never come across one!

fiddiwebb

Not fair, I use XP and never had a rootkit yet :mad:

Where can I get mine!

Maybe if I got rid of my free Avira AV I might get one :think:

Knarf44

Likewise. I've been using Avast and the Free Comodo Firewall for the last 3 years and never had a rootkit in that time.

closed

you wouldn't know unless you did a rootkit scan or booted from an AV CD.

Knarf44

In my case, although Avast includes rootkit scanning, I also use Panda's Anti Rootkit scanner now and again and so far it's never found anything.

You seem to be suggesting (apologies if I'm wrong) that most of us are ignorant of these things just because we use freeware. While I agree that perhaps to the average non technically minded PC user that ignorance is bliss, it's not to all of us. I take the protection of my Home Family PC seriously.

GunJack

don't forget Dr Web CureIt.....very very good at getting shut of rootkits that even Combofix doesn't always get..had a couple of clients with this type in the last month or so

Anyone tried Hitman Pro on one yet ???

GunJack

closed wrote: »

you wouldn't know unless you did a rootkit scan or booted from an AV CD.

Is this not quite true ?? Some behaviours seem to be caused by rootkits, such as stopping processes running, seemingly random errors on start-up, etc...and surely recognising the behaviours is/should be part of the defence mechanism, even if that is by human means ??

closed

Depends on the infection, and the user, they aren't supposed to be noticed, and symptoms can be confused with general windows flakiness.

GunJack

True, but you do tend to build up knowledge for what symptoms are related to generic types of infections....in the words of tesco, every little helps

Richie-from-the-Boro

GunJack wrote: »

don't forget Dr Web CureIt.....very very good at getting shut of rootkits that even Combofix doesn't always get..had a couple of clients with this type in the last month or so

Anyone tried Hitman Pro on one yet ???

For those who don't use DOS there is a standalone Windows version

- no need to use full DrWeb
- updateable
- no install to registry
- here

Be warned it takes 30 minutes for the quickie on a fully loaded machine !