Anti-rootkit tools

**Shawn_7** · 05-26-12 at 06:15 AM

For those who want to check if their PC is infected by rootkits I suggest to use two very useful free tools. Both don't require installation, just launch the exe.

F-Secure Blacklight (compatibility issues with Windows 7)

Code: Select All

 http://www.f-secure.com/en/web/labs_global/removal/blacklight

Kaspersky anti rootkit utility

Code: Select All

http://support.kaspersky.com/faq/?qid=208283363

MATROX · 05-26-12 at 07:04 AM

Yeah, +use AddBlock and next to your antivirus just have a good firewall like COMODO (its free and way better than most paid or in premium security suites incorporated firewalls) and a few back-up security programs like Malwarebytes' Anti-Malware, SUPERAntiSpyware Professional, and Hitman Pro maybe HijackThis and Norton Power Eraser to

**blaxroze** · 05-26-12 at 07:07 AM

Threat detected after scan using that kaspersky rootkit. Why does it detect sptd.sys as suspicious object? After several research I just know that the file is required for Daemon Tools. So I dont really know whether this thing is useful or not

**Shawn_7** · 05-26-12 at 07:12 AM

Quote: Originally Posted by blaxroze

Threat detected after scan using that kaspersky rootkit. Why does it detect sptd.sys as suspicious object? After several research I just know that the file is required for Daemon Tools. So I dont really know whether this thing is useful or not

I have Daemon tools too, but kaspersky rootkit search result is clean. maybe yout file is infected, you may submit it to virustotal for analysis

Code: Select All

https://www.virustotal.com/

**Mbbest** · 05-26-12 at 07:19 AM

I do know that my PC is not infected but I did it for fun and guess what? Results are 0 rootkits :P

**blaxroze** · 05-26-12 at 07:19 AM

Quote: Originally Posted by Shawn_7

I have Daemon tools too, but kaspersky rootkit search result is clean. maybe yout file is infected, you may submit it to virustotal for analysis

Code: Select All

https://www.virustotal.com/

Done, still didnt detect anything though

cavara · 05-26-12 at 08:18 AM

Thank you !

**Shawn_7** · 05-26-12 at 08:26 AM

Quote: Originally Posted by blaxroze

Done, still didnt detect anything though

It seems a legit file, however I have Daemon Tools, 7 ultimate 32bit, but cannot find sptd.sys anywhere.

Anyway perhaps yours is a false positive, it happens

**jbgoode** · 05-26-12 at 09:51 AM

One of my boxes got infected via USB.
yeah, some dude gave me a flash drive that had a rootkit hidden inside the recycle bin folder.
I never use anykind of these traditional AV suites but Winpatrol gave me the heads up one day with a message that Winlogon has been compromised.
I tried both of those 2 programs plus a couple of different ones like Sophos, Stinger, DarkSpy,Gmer, IceSword etcetera. Nuthin happened The bootkit was still there until I tried TrendMicros HouseCall.
It took a coupla minutes and a reboot and my box was clean as a whistle again.
I believe this is the best AV scanner out there.

Code: Select All

http://housecall.trendmicro.com/

Just sayin

**blaxroze** · 05-26-12 at 10:36 AM

Quote: Originally Posted by Shawn_7

It seems a legit file, however I have Daemon Tools, 7 ultimate 32bit, but cannot find sptd.sys anywhere.

Anyway perhaps yours is a false positive, it happens

a quick google of that file name will lead you to daemon tools though. False positive just like you said

**Shawn_7** · 05-26-12 at 10:56 AM

Quote: Originally Posted by jbgoode

One of my boxes got infected via USB.
yeah, some dude gave me a flash drive that had a rootkit hidden inside the recycle bin folder.
I never use anykind of these traditional AV suites but Winpatrol gave me the heads up one day with a message that Winlogon has been compromised.
I tried both of those 2 programs plus a couple of different ones like Sophos, Stinger, DarkSpy,Gmer, IceSword etcetera. Nuthin happened The bootkit was still there until I tried TrendMicros HouseCall.
It took a coupla minutes and a reboot and my box was clean as a whistle again.
I believe this is the best AV scanner out there.

Code: Select All

http://housecall.trendmicro.com/

Just sayin

Mine was just a suggestion concerning free rootkit remover, I suppose trendmicro housecall is free too. Anyway glad for you for having eventually removed that rootkit that probably was not yet in F-Secure and Kaspersky's databases.

IMO the best antispyware software (not free, unfortunately) is pctools spyware doctor

Code: Select All

http://www.pctools.com/spyware-doctor/

**Mbbest** · 05-26-12 at 02:08 PM

^
No way, imo its the Malwarebytes antimalware.

Combination of FREE Malwarebytes + FREE Rkill + Free Microsoft antivirus = clean any piece of AV/malware that I have job with.

**Shawn_7** · 05-26-12 at 03:34 PM

malwarebytes is a good antispyware, pity the free version hasn't real-time protection. I don't know rkill, and ms antivirus on modded crackendale OS ... no, better not to test if it phones home to mom ms and then says

Achtung! Geheime Reichssache! Geheime Staats Polizei caught you mit nein oricinal Fenster copien! Ein KZ is waiting for you!

snapp · 05-26-12 at 10:59 PM

cool thanks did a scan it came up good

05-26-12 at 07:12 AM	#4
Shawn_7 Elder Join Date: Apr 2012 Location: Eventyrland Posts: 3,515	Quote: Originally Posted by blaxroze Threat detected after scan using that kaspersky rootkit. Why does it detect sptd.sys as suspicious object? After several research I just know that the file is required for Daemon Tools. So I dont really know whether this thing is useful or not I have Daemon tools too, but kaspersky rootkit search result is clean. maybe yout file is infected, you may submit it to virustotal for analysis Code: Select All https://www.virustotal.com/

05-26-12 at 07:19 AM	#6
blaxroze Expert Join Date: Aug 2011 Posts: 950	Quote: Originally Posted by Shawn_7 I have Daemon tools too, but kaspersky rootkit search result is clean. maybe yout file is infected, you may submit it to virustotal for analysis Code: Select All https://www.virustotal.com/ Done, still didnt detect anything though

05-26-12 at 09:51 AM	#9
jbgoode Expert Join Date: Jun 2009 Location: Way over yonder (expat) Posts: 581	One of my boxes got infected via USB. yeah, some dude gave me a flash drive that had a rootkit hidden inside the recycle bin folder. I never use anykind of these traditional AV suites but Winpatrol gave me the heads up one day with a message that Winlogon has been compromised. I tried both of those 2 programs plus a couple of different ones like Sophos, Stinger, DarkSpy,Gmer, IceSword etcetera. Nuthin happened The bootkit was still there until I tried TrendMicros HouseCall. It took a coupla minutes and a reboot and my box was clean as a whistle again. I believe this is the best AV scanner out there. Code: Select All http://housecall.trendmicro.com/ Just sayin

05-26-12 at 10:56 AM	#11
Shawn_7 Elder Join Date: Apr 2012 Location: Eventyrland Posts: 3,515	Quote: Originally Posted by jbgoode One of my boxes got infected via USB. yeah, some dude gave me a flash drive that had a rootkit hidden inside the recycle bin folder. I never use anykind of these traditional AV suites but Winpatrol gave me the heads up one day with a message that Winlogon has been compromised. I tried both of those 2 programs plus a couple of different ones like Sophos, Stinger, DarkSpy,Gmer, IceSword etcetera. Nuthin happened The bootkit was still there until I tried TrendMicros HouseCall. It took a coupla minutes and a reboot and my box was clean as a whistle again. I believe this is the best AV scanner out there. Code: Select All http://housecall.trendmicro.com/ Just sayin Mine was just a suggestion concerning free rootkit remover, I suppose trendmicro housecall is free too. Anyway glad for you for having eventually removed that rootkit that probably was not yet in F-Secure and Kaspersky's databases. IMO the best antispyware software (not free, unfortunately) is pctools spyware doctor Code: Select All http://www.pctools.com/spyware-doctor/

05-26-12 at 07:04 AM	#2
MATROX Elite Join Date: Apr 2009 Location: AREA 51 Posts: 2,053	Yeah, +use AddBlock and next to your antivirus just have a good firewall like COMODO (its free and way better than most paid or in premium security suites incorporated firewalls) and a few back-up security programs like Malwarebytes' Anti-Malware, SUPERAntiSpyware Professional, and Hitman Pro maybe HijackThis and Norton Power Eraser to

05-26-12 at 07:07 AM	#3
blaxroze Expert Join Date: Aug 2011 Posts: 950	Threat detected after scan using that kaspersky rootkit. Why does it detect sptd.sys as suspicious object? After several research I just know that the file is required for Daemon Tools. So I dont really know whether this thing is useful or not

05-26-12 at 07:19 AM	#5
Mbbest No kitty! bad kitty!!! Join Date: Aug 2008 Location: Southpark Posts: 1,660	I do know that my PC is not infected but I did it for fun and guess what? Results are 0 rootkits :P

05-26-12 at 08:18 AM	#7
cavara Novice Join Date: Jan 2009 Posts: 127	Thank you !

05-26-12 at 08:26 AM	#8
Shawn_7 Elder Join Date: Apr 2012 Location: Eventyrland Posts: 3,515	Quote: Originally Posted by blaxroze Done, still didnt detect anything though It seems a legit file, however I have Daemon Tools, 7 ultimate 32bit, but cannot find sptd.sys anywhere. Anyway perhaps yours is a false positive, it happens

05-26-12 at 10:36 AM	#10
blaxroze Expert Join Date: Aug 2011 Posts: 950	Quote: Originally Posted by Shawn_7 It seems a legit file, however I have Daemon Tools, 7 ultimate 32bit, but cannot find sptd.sys anywhere. Anyway perhaps yours is a false positive, it happens a quick google of that file name will lead you to daemon tools though. False positive just like you said

05-26-12 at 02:08 PM	#12
Mbbest No kitty! bad kitty!!! Join Date: Aug 2008 Location: Southpark Posts: 1,660	^ No way, imo its the Malwarebytes antimalware. Combination of FREE Malwarebytes + FREE Rkill + Free Microsoft antivirus = clean any piece of AV/malware that I have job with.

05-26-12 at 03:34 PM	#13
Shawn_7 Elder Join Date: Apr 2012 Location: Eventyrland Posts: 3,515	malwarebytes is a good antispyware, pity the free version hasn't real-time protection. I don't know rkill, and ms antivirus on modded crackendale OS ... no, better not to test if it phones home to mom ms and then says Achtung! Geheime Reichssache! Geheime Staats Polizei caught you mit nein oricinal Fenster copien! Ein KZ is waiting for you!

05-26-12 at 10:59 PM	#14
snapp Newcomer Join Date: May 2012 Posts: 38	cool thanks did a scan it came up good