Rootkits: another kind of nasty malware

[steve2470]

https://en.wikipedia.org/wiki/Rootkit

Of course, most of us here are very aware of this threat. Just an FYI to our less experienced members.

Found this, no clue how good it is:

http://www.malwarebytes.org/antirootkit/

[JayhawkSD]

1. Malwarebytes is excellent. n/t

[Earth Bound Misfit]

2. This about MBAR (Anti-Rootkit - currently still in Beta) @Bleepingcomputer...

http://www.bleepingcomputer.com/download/malwarebytes-anti-rootkit/

BleepingComputer Review:

Malwarebytes Anti-Rootkit is a free program that can be used to search for and remove rootkits from your computer. When started, Malwarebytes Anti-Rootkit will scan your computer and allow you to remove any rootkits that it finds.

A rootkit is a malware program that is designed to hide itself or other computer infections from being seen or detected on your computer. This is why specialized applications, such as Malwarebytes Anti-Rootkit, are created whose sole purpose is to find these types of infections.
This program is currently in Beta and should only be used if you are comfortable using this type of software.

This program can target the following types of rootkits:

Kernel mode drivers hiding themselves like TDL1, TDL2/TDSS, MaxSS, Srizbi, Necurs, Cutwail, etc.
Kernel mode driver patchers/infectors, embedding malicious code into core files of an Operating System, such as TDL3, ZeroAccess, Rloader, etc.
Master Boot Record infectors such as TDL4, Mebroot/Sinowal, MoastBoot, Yurn, Pihar, etc.
Volume Boot Record/OS Bootstrap infectors like Cidox
Disk Partition table infectors like SST/Alureon
User mode patchers/infectors like ZeroAccess.

The usual warning is given about using Beta software.

[frylock]

3. i've had a lot of success removing rootkits on several systems using combofix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix