Rootkit Removal
A relatively recent malware innovation raises the stakes in computer security considerably. This technique of delivering Trojan programs is called a rootkit. Typically, a rootkit is designed to take control of the infected computer with administrator ("root") privileges, and do so without the user's awareness. That can be very dangerous, indeed. But even worse, rootkits often elude detection by mainstream anti-malware software. Here's how to remove a rootkit... |
How Do I Remove a Rootkit?
With remote control of a rootkit implanted in your computer, bad guys can use your system to commit crimes. Authorities may trace the criminal activity back to your IP address, and you may need a lawyer; a forensic computer expert witness; and lots of money. Rootkits can even lock you out of your own system, transmit your private data to a bad guy, send thousands of spam emails, even set up a child porn distribution website on your computer -- all without your knowledge. Yes, rootkits are very serious; it's important to be on guard against them constantly, and remove them immediately.
Once embedded in your computer, a rootkit modifies operating system components so that built-in security functions ignore the rootkit and whatever it does. It can also mask itself from many anti-malware programs.
The stdrt.exe rootkit, for example, masquerades as a Microsoft utility called FlexNet Licensing Service in Task Manager. FlexNet is legitimately used to manage compliance with software licenses on corporate networks; do not assume that FlexNet is malware. The rootkit simply assumed its identity. The rootkit, with the file name "stdrt.exe," went undetected on a friend's computer by Avast! Antivirus and MalwareByte's Anti-Malware (MBAM), two of the most highly regarded anti-malware programs. The only thing that alerted him to the possibility of infection was the rootkit's massive consumption of CPU resources. Other processes slowed down considerably, and Task Manager revealed that something called stdrt.exe was chewing up over 200 MB of RAM and 3 to 10 per cent of the CPU capacity.
It can be difficult to get rid of these things, because they are built to resist your attempts to remove them. Stopping the stdrt.exe process with Task Manager worked only until the next reboot. Deleting the file did no good; somewhere, another program recreated stdrt.exe upon reboot. Cleaning the registry of references to stdrt.exe also failed; they registry keys were recreated. Full system scans with Avast! and MBAM turned up nothing for them to quarantine. But finally, I found a rootkit removal utility that worked.
UnHackMe by Greatis Software is one of the first antirootkit utilities. It's a bit overwhelming for novice users, but if you read the wizard's somewhat technical instructions and follow them carefully, cleaning out a rootkit is a simple, three-click process.
Rootkit detection utilities include RootkitRevealer for Windows and Rootkit Hunter for Linux. However, these programs will only detect rootkits; removing a rootkit is left up to the user. They are designed for advanced IT system administrators.
Other rootkit removal tools that eliminate rootkits from your system include Lavasoft's ARIES Rootkit Remover, DiamondCS ProcessGuard, BitDefender Antirootkit Beta, and McAfee's Rootkit Detective. Beware of downloading rootkit removal utilities from any unknown third-party distribution site. The rootkit removal tool itself may be malware.
Because rootkits are meant to operate in stealth mode, it can be difficult to detect them on your computer. If you notice your computer is running a lot slower than usual, or your anti-virus program has been disabled, it's a good idea to scan for rootkits.
Do you have something to say about rootkits? Post your comment or question below...
|
|
Share this article with friends! |
|
Posted by Bob Rankin on 6 Jul 2010
| Need More Help? Try the AskBobRankin Updates Newsletter. It's Free! |
 |
Prev Article: CPU Benchmarking |
The Top Twenty |
Next Article: T1 Service Provider |
 |
|
Link to this article from your site or blog. Just copy and paste from this box: |
There's more reader feedback... See all 18 comments for this article.
Post your Comments, Questions or Suggestions
Free Tech Support -- Ask Bob Rankin
Subscribe to AskBobRankin Updates: Free Newsletter |
||
|
Copyright © 2005
- Bob Rankin - All Rights Reserved
Privacy Policy -- See my profile on Google. |
||
Article information: AskBobRankin -- Rootkit Removal (Posted: 6 Jul 2010)
Source: http://askbobrankin.com/rootkit_removal.html
Copyright © 2005 - Bob Rankin - All Rights Reserved
Free
Most recent comments on "Rootkit Removal"
(See all 18 comments for this article.)Posted by:
Roger Lancina
08 Jul 2010
I have been using combofix with good success.
Posted by:
RaoulDuke5244
08 Jul 2010
Is the Mac o/s on the rootkit-scare-list? Probably not, but it would generally help the reader to state explicitly in the first line of the article what o/s's are vs. are not affected when discussing malware.
EDITOR'S NOTE: Mac OS X is unix with a pretty face. So YES, it could be vulnerable to a rootkit attack. See http://theappleblog.com/2008/01/23/why-mac-security-matters-os-x-rootkit-hunter/
Posted by:
RaoulDuke5244
09 Jul 2010
Thanks for the URL vector re possible Mac o/s x rootkit attack. It appears that a few knowledgeable people think it still isn't worthwhile scanning for o/s x malware, a few think it may be worthwhile especially for servers and a few swear that their personal machines have been taken over by unidentified forces of evil. Probably, the best approach at this time is to not bother scanning for o/s x rootkits unless you run a server farm but to be damn certain that you trust what you're installing before typing in an o/s x admin. password!
Posted by:
John Komdat
09 Jul 2010
Rootkit Revealer is a great program but supposedly it does not work on 64 bit Windows. Does anyone know if this is true and whether UnHackMe will work on 64 bit systems?
Posted by:
Juanita Moore
14 Jul 2010
Last year I had a rootkit virus on my computer and nothing would take it off. I finally just bit the bullet and reformatted the c-drive with my restore disk and started over.
Posted by:
Roku
15 Jul 2010
I downloaded UnHackMe and when I try to start it my AdAware Ad-Watch Live! monitor blocks it saying the reaminator.exe process has been identified as Win32.Worm.Mabezat!
What's up with that???!! I have uninstalled the product, awaiting a response from you...
EDITOR'S NOTE: Are you sure you downloaded Unhackme from the official site? If so, it sounds like a false positive.
Posted by:
Jack
30 Jul 2010
Just for curiosity's sake,after reading this blog, I intalled Reanimator: it gave me some yellow fair warnings mostly about unfamiliar codecs (from KMPlayer,I think) & Autodetect from Rogers wireless stick...nothing serious,...I did not send report or delete my codecs. Did not install UNhackme.
but then my heretofore stable PC, became a little crazy, ATI All in WonderPro TV tuner lost it's sound, tried reinstalling, drivers no longer seen...fixed that, then it was something else, been chassing ghosts for two days, still no sound for TV tuner, used system restore...twice..got even worse with many double entries"(2)" in Program files, filally used a saved ERUNT's "ERNDT" registry image from a month ago, cleaned up extra program files manualy, now seems to be stable,..will next disable RESTORE, shutdown XP, then re-enable it. Will then eradicate ATI All in Wonder and drivers and try to re-install it. Hope it will work,.. fairly confident... if not, I'll reboot XP, no big deal...I learn from experience...kind of fun isn't it.
After only one year of reading BOB's newsletters, I'm never "really" stuck anymore, and I even use LINUX now on my other drive, so in the end, I can still honestly say thank you so much BOB for the all the tricks, and the independence & confidence you've given me.(This is my first post)
Posted by:
Marc Erickson
24 Dec 2010
@Ariel6345: Usually the rootkit will be backed up by System Restore and thus be reactivated when a restore point is used.
Marc Erickson
Vancouver Computers Examiner
http://www.examiner.com/x-34009-Vancouver-Computers-Examiner
Posted by:
Jose
06 Feb 2011
What about the Rootkit Eliminator from F-Secure named Blacklight !!!!
It is a free download program and can eliminate any rootkit on your computer, I think you have to be more thorough with the programs you compare with.....
Posted by:
sean
23 Jun 2011
I am a IT mgr of small company(23 employees)
One of the employee sent his laptop to me asking to remove virus.
I'm not an expert of Virus, but I found that two instances of iexplore.exe is keep showing in taskmgr. I tried to get rid of them by many anti virus/spam but no result.Struggled couple of days, spent many hours , but in the end "unhackme" did remove the iexplore.exe. MANY many thanks for unhackme.com!!